CVE-2026-67410 rabbitmq CVE debrief

Who should care

RabbitMQ administrators and security teams should assess exposure and prioritize remediation. They should verify their deployments, review the OAuth2 client secret configuration, and consider rotation. Security teams should also review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-67410 is a high-severity vulnerability in RabbitMQ that exposes the OAuth2 client secret via an unauthenticated JavaScript endpoint, potentially leading to token theft and client impersonation. RabbitMQ administrators and security teams should assess exposure and prioritize remediation.

• Potential token theft and client impersonation
• Exposure of sensitive OAuth2 client secret
• Possible unauthorized access to RabbitMQ Management UI

Technical summary

The vulnerability exposes the OAuth2 client secret in the JavaScript served by the unauthenticated endpoint /js/oidc-oauth/bootstrap.js. This occurs when OAuth2 authentication is enabled for the RabbitMQ Management UI and the configured flow uses a client secret. The exposure allows an attacker to retrieve the OAuth2 client secret without authentication, potentially leading to token theft and client impersonation. The affected versions are 4.2.0 to 4.3.3 and 4.2.9. The issue is fixed in versions 4.3.3 and 4.2.9. RabbitMQ administrators should assess their exposure and prioritize remediation.

Defensive priority

Immediate verification of RabbitMQ deployments and remediation via version updates are crucial.

Recommended defensive actions

• Verify RabbitMQ deployment versions and assess exposure
• Update RabbitMQ to version 4.3.3 or 4.2.9
• Review OAuth2 client secret configuration and consider rotation
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The RabbitMQ Management UI is impacted when OAuth2 authentication is enabled and the configured flow uses a client secret. The unauthenticated endpoint /js/oidc-oauth/bootstrap.js serves JavaScript that includes the oauthclientsecret configuration value. This issue is fixed in versions 4.3.3 and 4.2.9. RabbitMQ administrators and security teams should verify their deployments and consider rotating the OAuth2

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.