RabbitMQ obsolete /api/auth endpoint leaks OAuth client secret
An obsolete endpoint in RabbitMQ's management plugin returned the broker's OAuth 2 client secret to unauthenticated callers on installations configured with management.oauth_client_secret. NVD scored 7.5.
- Vendor
- RabbitMQ (Broadcom / VMware Tanzu)
- Product
- RabbitMQ Server (management plugin, versions 3.13.0 through the fixed lines below)
- CVSS
- 7.5
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
An OAuth 2 client-secret disclosure in the RabbitMQ management plugin. NVD scores CVSS 3.1 = 7.5 (high) — unauthenticated network access, no user interaction, high confidentiality impact, no integrity or availability impact directly, though follow-on token exchange gets an attacker to broker admin.
What the flaw is (per NVD): “Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauth_client_secret, exposing credentials to unauthenticated callers when the management plugin and that OAuth configuration are enabled.”
The endpoint was superseded but never removed. Reachable unauthenticated on any deployment that both loads the management plugin and configures OAuth 2 with a static client secret — a common enterprise posture. The returned secret can be exchanged for a broker administrator token via the normal OAuth flow, at which point the broker treats the caller as legitimate.
Status: Fixed in 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15 per the RabbitMQ security advisory GHSA-pj24-8j6m-vq9q. Discovered and reported by Miggo’s security team; present in the codebase since early 2024 per Miggo’s disclosure. No known exploitation in the wild ahead of disclosure.
What to do: Upgrade to one of the fixed lines above. If an upgrade has to wait, keep the management API off the public network and audit recently-issued administrator tokens for any you don’t recognize. Rotating the management.oauth_client_secret after upgrade is prudent for any deployment that had the vulnerable endpoint reachable from an untrusted network.
