# CVE-2026-67410

Unauthenticated endpoint exposes OAuth2 client secret in RabbitMQ Management UI

- Page: https://www.vulneraibility.com/cve/CVE-2026-67410
- CVSS: 8.2
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.41% (percentile 35.4)
- CISA SSVC: exploitation poc, automatable no, technical impact partial (assessed 2026-09-25)
- Weakness: CWE-200
- Also known as: GHSA-f9f2-q3jf-wfj3
- Published: 2026-09-25

## Affected versions

- rabbitmq: affected >= 4.2.0 and < 4.2.9; >= 4.3.0 and < 4.3.3; fixed in 4.2.9, 4.3.3 (Bitnami advisory, via OSV)
- rabbitmq rabbitmq-server: affected >= 4.3.0 and < 4.3.3; >= 4.2.0 and < 4.2.9

A version outside these ranges is not a statement that it is unaffected.

## Impact

Attacker can retrieve OAuth2 client secret, complete auth-code flows, obtain tokens and impersonate clients on affected RabbitMQ deployments.

## Action

Immediate action required

## Recommendation

Upgrade to 4.2.9 or 4.3.3 and restrict/ firewall management UI access

## References

- [other] https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-f9f2-q3jf-wfj3
- [other] https://github.com/rabbitmq/rabbitmq-server/commit/60a85d3605ebf94fd234497242812547d441d457
- [other] https://github.com/rabbitmq/rabbitmq-server/commit/869f800998334bb363f2ad046f58de9caedc409e
- [other] https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9
- [other] https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.