CVE-2026-67410: RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.3.3 and 4.2.9, OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint (CWE-200). when OAuth2 authentication is enabled for the RabbitMQ Management UI and the configured flow, IDP use a client secret, the oauthclientsecret configuration value is included in the JavaScript served by the unauthenticated endpoint /js/oidc-oauth/bootstrap.js. Any user who can reach the management UI port can retrieve the OAuth2 client secret without Files: deps/rabbitmqmanagement/src/rabbitmgmtwmauth.erl, line 186 deps/rabbitmqmanagement/src/rabbitmgmtoauthbootstrap.erl, lines 35-50 deps/rabbitmqmanagement/src/rabbitmgmtdispatcher.erl, lines 45-49 (route registration) Code Path: 1. The route /js/oidc-oauth/bootstrap.js is registered as a plain Cowboy handler (rabbitmgmtdispatcher.erl:46): Credential exposure for the affected configuration: OAuth2 client secret is accessible without any authentication Token theft: Attacker can complete the authorization code flow using stolen authorization codes Client impersonation: Attacker can make requests. Any RabbitMQ deployment with: This issue is fixed in versions 4.3.3 and 4.2.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.3.3 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.2.9
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments are exposed when the RabbitMQ Management UI uses OAuth2 authentication and the configured identity-provider flow uses a client secret. The affected releases are 4.2.0 through 4.2.8 and 4.3.0 through 4.3.2.
What does an attacker need to retrieve the credential?
The attacker only needs network access to the RabbitMQ Management UI port. The bootstrap JavaScript endpoint is unauthenticated, so no RabbitMQ login is required.
What can be done if an upgrade cannot happen immediately?
Restrict access to the RabbitMQ Management UI port so untrusted users cannot reach it. This limits access to the unauthenticated endpoint that exposes the client secret.
How can I determine whether an instance is affected?
Check whether the instance runs an affected version, has OAuth2 enabled for the Management UI, and uses an identity-provider flow configured with a client secret. An exposed instance allows unauthenticated retrieval of /js/oidc-oauth/bootstrap.js from the Management UI.
Which versions contain the fix?
The issue is fixed in RabbitMQ versions 4.2.9 and 4.3.3.