Trending
CVE-2026-57219

CVE detail

CVE-2026-57219

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauth_client_secret, exposing credentials to unauthenticated callers when the management plugin and that OAuth configuration are enabled. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

CVSS 8.7 · HighBuzz score 39.5

Buzz score

Why this CVE is surfacing

Buzz score total 39.5

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 23.0 · diversity 16.5 · KEV 0.0 · OTX 0.0 · PoC 0.0

Mention score

23.0

9 evidence mentions in the snapshot

Diversity score

16.5

4 sources across 3 categories

KEV score

0.0

No KEV entry observed

OTX score

0.0

0 OTX pulses

PoC score

0.0

0 repos · best confidence N/A

Best PoC traction

Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions: 9; within the 30d window
Peak daily: 6; highest bucket

Evidence

Source links by recency

Newest mentions first

9 source links · newest first

⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and MoreThe Hacker News
on a standard WordPress installation, without requiring any plugins or other special conditions. It is a combination of CVE-2026-63030 (REST API batch-route confusion) and CVE-2026-60137 (SQL injection in WordPress core) that can be chained to turn an anonymous request into code execution. watchTowr said it's already seeing proof-of-concept (PoC) explo
newsthehackernews.comJul 20, 2026, 1:32 PM
CVE-2026-57219 RabbitMQ: Unauthenticated disclosure of OAuth client credentials via an HTTP API endpoint with certain less common OAuth 2 configurationsMicrosoft MSRC
Information published.
vendormsrc.microsoft.comJul 15, 2026, 8:02 AM
RabbitMQ flaws expose OAuth secrets, risk complete takeover of the brokerCSO Online
w been fixed in all supported versions. Obsolete endpoint leaked OAuth configurations The more severe issue, tracked as CVE-2026-57219, allows anyone with network access to RabbitMQ’s management interface to receive the broker’s OAuth client secret without authentication. The flaw stems from an obsolete management endpoint “GET/api/auth” that returned
newswww.csoonline.comJul 13, 2026, 12:01 PM
https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj24-8j6m-vq9qgithub.com
No excerpt available.
Exploitgithub.comJul 10, 2026, 9:16 PM
https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6github.com
No excerpt available.
Exploitgithub.comJul 10, 2026, 9:16 PM
https://github.com/rabbitmq/rabbitmq-server/pull/16086github.com
No excerpt available.
Exploitgithub.comJul 10, 2026, 9:16 PM
https://github.com/rabbitmq/rabbitmq-server/pull/16083github.com
No excerpt available.
Exploitgithub.comJul 10, 2026, 9:16 PM
https://github.com/rabbitmq/rabbitmq-server/commit/aa387c4451e7b674df3e3ba89df86a99d697cc7fgithub.com
No excerpt available.
Exploitgithub.comJul 10, 2026, 9:16 PM
https://github.com/rabbitmq/rabbitmq-server/commit/98b1daf740237c85941e8addcbea6e74f4a2743cgithub.com
No excerpt available.
Exploitgithub.comJul 10, 2026, 9:16 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars

No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence

CVE-2026-52855
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates…
CVSS 9.9 · Critical
3 mentions
CVE-2026-54660
swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --au…
CVSS 7.4 · High
4 mentions
CVE-2026-44979
@hapi/wreck is an HTTP client utility. Prior to 18.1.1, when @hapi/wreck follows a 3xx redirect to a different hostname, only the Authorization and Cookie headers are stripped, an…
CVSS 6.3 · Medium
4 mentions
CVE-2026-47282
Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVSS 6.5 · Medium
5 mentions
CVE-2026-59209
n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated member with use-only editor access to a shared workflow could read cre…
CVSS 7.1 · High
3 mentions
CVE-2026-55188
RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, RustFS contains an authorization bypass in the bucket replication admin API. Th…
CVSS 8.2 · High
1 mention

External lookup

Potential internet exposure

Potential exposure only — not proof of vulnerability.Shodan results indicate potentially internet-exposed products, not confirmed vulnerable systems. They do not confirm that any returned system is vulnerable to CVE-2026-57219.

Product-level CPE searches intentionally omit version fields and NVD version-range or configuration certainty. Verify the exact product version and configuration independently.

Sign-in required. Shodan requires you to sign in to run these filter searches.

Product CPE queries

Derived from this CVE's existing NVD CPE 2.3 records; the application, operating-system, or hardware part is retained.

cpe:2.3:a:broadcom:rabbitmq_serverSearch this product on Shodan

Exact CVE query

Eligible paid Shodan plan required

Shodan's exact vuln: filter is separate from the product searches above and requires an eligible paid Shodan plan.

vuln:CVE-2026-57219Search this CVE on Shodan

These are outbound search links only. cvebuzz makes no Shodan API call, uses no Shodan API key, and does not display live result counts.

Metadata

Canonical fields

NVD status

Analyzed

Published

Jul 10, 2026

Modified

Jul 29, 2026

Official record

Authoritative NVD record

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CWE IDs

Vendor classifications

How this vector reads

CVSS 4.0 base metrics decoded below. This explanation does not recalculate or change the NVD score.

Attack Vector (AV): Network. The vulnerable system can be reached across network boundaries.
Attack Complexity (AC): Low. No special conditions beyond the attacker-controlled steps are required.
Attack Requirements (AT): Present. A prerequisite deployment or execution condition must be present.
Privileges Required (PR): None. The attacker needs no privileges on the vulnerable system.
User Interaction (UI): Active. A targeted user must perform a specific action for exploitation to succeed.
Vulnerable System Confidentiality (VC): High. There is a total or serious impact to this security property.
Vulnerable System Integrity (VI): High. There is a total or serious impact to this security property.
Vulnerable System Availability (VA): None. There is no direct impact to this security property.
Subsequent System Confidentiality (SC): High. There is a total or serious impact to this security property.
Subsequent System Integrity (SI): High. There is a total or serious impact to this security property.
Subsequent System Availability (SA): None. There is no direct impact to this security property.

Optional CVSS v4 metrics remain in the raw vector; only base metrics are expanded here.

Signals

Exploitation indicators

0 stored signals · no KEV · 0 OTX pulses