CVE-2026-57218CWE-863

RabbitMQ: AMQP 0-9-1 in combination with OAuth 2: consumer persistence can lead to post-revocation message disclosure

Medium · published July 10, 2026

CVSS v4.0
4.9
EPSS
0%
Percentile
27.6
In the wild
Unconfirmed
What it is

RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expiry or connection.update_secret refresh to reduced scopes because existing consumers are not canceled or reauthorized at delivery time after the channel user state changes. This issue is fixed in version 4.2.6.

The record
Technical detail
CVSS v4.0
4.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00352 · 27.6th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-07-10T20:21Z
EPSS history
Timeline
  • 10 JUL 20:21Z
    RabbitMQ: AMQP 0-9-1 in combination with OAuth 2: consumer persistence can lead to post-revocation message disclosure
    cvelistv5