CVE-2026-57218: RabbitMQ: AMQP 0-9-1 in combination with OAuth 2: consumer persistence can lead to post-revocation message disclosure
RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expiry or connection.updatesecret refresh to reduced scopes because existing consumers are not canceled or reauthorized at delivery time after the channel user state changes. This issue is fixed in version 4.2.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RabbitMQ AMQP 0-9-1 with OAuth 2to a version that resolves this vulnerability.Fixed in 4.2.6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57218?
CVE-2026-57218 has a medium severity rating of 4.9 according to the CVSS system.
How do I fix CVE-2026-57218?
To fix CVE-2026-57218, upgrade RabbitMQ to version 4.2.6 or later.
What are the implications of CVE-2026-57218?
CVE-2026-57218 allows existing consumers to receive messages even after OAuth token expiry, leading to potential message disclosure.
Which versions of RabbitMQ are affected by CVE-2026-57218?
RabbitMQ versions prior to 4.2.6 are affected by CVE-2026-57218.
What can I do to mitigate CVE-2026-57218 if I can't upgrade?
If an upgrade is not feasible, consider implementing stricter OAuth token policies and monitoring consumer connections closely.