CVE-2026-67410

Executive Summary

CVE-2026-67410 is a credential exposure vulnerability in RabbitMQ's Management UI in which the configured OAuth2 client secret is embedded in a JavaScript file served by an unauthenticated endpoint. Any network actor who can reach the management UI port can retrieve the secret without authentication. The issue affects RabbitMQ versions 4.2.0 through 4.2.8 and 4.3.0 through 4.3.2; it is fixed in 4.3.3 and 4.2.9.

Technical Analysis

RabbitMQ is a messaging and streaming broker. When OAuth2 authentication is enabled for the RabbitMQ Management UI and the configured flow/Identity Provider (IDP) uses a client secret, the oauthclientsecret configuration value is included in the JavaScript served by the unauthenticated endpoint /js/oidc-oauth/bootstrap.js. This is a CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) condition. The vulnerable code path is referenced at deps/rabbitmq_management/src/rabbit_mgmt_wm_auth.erl (line 186), deps/rabbitmq_management/src/rabbit_mgmt_oauth_bootstrap.erl (lines 35–50), and deps/rabbitmq_management/src/rabbit_mgmt_dispatcher.erl (lines 45–49 for route registration). The route /js/oidc-oauth/bootstrap.js is registered as a plain Cowboy handler in rabbit_mgmt_dispatcher.erl:46, meaning the endpoint is served without an authentication or authorization check. As a result, the OAuth2 client secret is disclosed to anyone who can reach the management UI port.

Because the secret is delivered as static JavaScript, no special HTTP method, parameter, or authenticated session is required to retrieve it; a single unauthenticated GET to the well-known path returns the secret-containing bundle. This lowers the exploitation bar to basic network reachability of the management interface.

Exploitation Scenarios

No public proof-of-concept is available; the attack chain below is inferred from the vulnerability class (unauthenticated sensitive data exposure) and the details in the NVD description.

1. Reconnaissance / target identification: The attacker identifies an exposed RabbitMQ Management UI. The management plugin typically listens on TCP port 15672, and the UI presents a recognizable login page. Scanning services such as Shodan or internet-wide scanners can fingerprint RabbitMQ management instances.

2. Triggering the flaw: The attacker issues an unauthenticated HTTP GET request to /js/oidc-oauth/bootstrap.js on the management UI port. Because the route is registered as a plain Cowboy handler and requires no authentication, the server returns the JavaScript response containing the oauthclientsecret configuration value. No credentials, tokens, or prior session are needed.

3. Payload/execution method (vulnerability-class level): This is not a code-execution vulnerability. The "payload" is a simple retrieval of a static JavaScript resource; the sensitive material is the OAuth2 client secret embedded in the response body. The attacker parses the secret from the JavaScript content.

4. Post-exploitation impact: With the OAuth2 client secret, an attacker can complete the authorization code flow using stolen authorization codes, perform token theft, and engage in client impersonation by making requests as the legitimate OAuth2 client. The description notes the attacker can "make requests" using the stolen secret, potentially undermining the trust model of the OAuth2 integration and enabling unauthorized access to resources protected by the IDP-trusted client.

Remediation (post-condition): The underlying issue is fixed in 4.3.3 and 4.2.9. As noted, this is unpatched in tracked sources; no public exploit code or Nuclei template is available, and there is no EPSS score.

Impact Assessment

• Confidentiality impact is high: the OAuth2 client secret is disclosed to any unauthenticated party with network access to the management UI port.
• Integrity impact is high: possession of the client secret enables client impersonation and requests as the legitimate client.
• Availability impact is none per the vulnerability's nature (credential exposure rather than denial of service).
• Attack vector is network (AV:N), complexity low (AC:L), no privileges required (PR:N), no user interaction (UI:N).
• Blast radius: all RabbitMQ deployments where OAuth2 authentication is enabled for the Management UI and the configured flow/IDP uses a client secret. The exposure occurs on the management UI listener; segmentation limits, but does not eliminate, the exposure if the port is reachable.
• Business impact: unauthorized access or impersonation via the IDP may lead to lateral movement, unauthorized message broker access, and downstream system compromise. Because credentials are included in static JavaScript, they may be cached by proxies or clients, widening the exposure window.

Detection Guidance

Sigma Rule

title: RabbitMQ Management UI OAuth2 Bootstrap.js Unauthenticated Access
id: 6f2a1c9e-3b7d-4e21-9c8a-1d2e3f4a5b6c
status: experimental
description: Detects unauthenticated HTTP GET requests to the RabbitMQ Management UI endpoint that leaks the OAuth2 client secret.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-67410
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: webserver
  product: rabbitmq
detection:
  selection_method:
    cs-method: 'GET'
  selection_uri:
    cs-uri-stem|endswith: '/js/oidc-oauth/bootstrap.js'
  selection_status:
    sc-status: 200
  condition: selection_method and selection_uri and selection_status
fields:
  - c-ip
  - cs-uri-stem
  - sc-status
falsepositives:
  - Legitimate management UI loads by administrators (expected from authorized IPs)
level: high

YARA Rule

rule CVE_2026_67410_RabbitMQ_OAuth2_Secret_Bootstrap
{
    meta:
        description = "Detects RabbitMQ oidc-oauth bootstrap.js content exposing OAuth2 client secret"
        author = "Threat Intelligence"
        reference = "CVE-2026-67410"
        date = "2026-01-01"
        severity = "high"
    strings:
        $path = "/js/oidc-oauth/bootstrap.js"
        $secret_kw = "oauthclientsecret" nocase
        $oauth_kw = "oauth" nocase
    condition:
        $path or ($secret_kw and $oauth_kw)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-67410 RabbitMQ Management UI OAuth2 bootstrap.js OAuth Client Secret Exposure Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/js/oidc-oauth/bootstrap.js"; nocase; classtype:attempted-recon; reference:cve,2026-67410; sid:202667410; rev:1;)

Elastic Detection

network where
  http.request.method == "GET" and
  endsWith(http.request.uri, "/js/oidc-oauth/bootstrap.js")

Splunk SPL Query

index=web (cs_method=GET OR http_method=GET)
    uri_path="/js/oidc-oauth/bootstrap.js"
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as source_ips by dest_host, uri_path
| where count > 0
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="rabbitmq,web,credential_exposure,">
  <rule id="100640" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>/js/oidc-oauth/bootstrap.js</url>
    <description>CVE-2026-67410: Unauthenticated access to RabbitMQ Management UI OAuth2 bootstrap.js - possible OAuth client secret disclosure</description>
    <mitre>
      <id>T1552.001</id>
    </mitre>
    <group>credential_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict network access to the RabbitMQ Management UI port (default 15672) using firewall rules, security groups, or reverse-proxy allow-lists so that only trusted administrative networks can reach it.
   • Where feasible, disable the management UI or the OAuth2-enabled Management UI on internet-exposed brokers.
   • Rotate the OAuth2 client secret configured for the IDP/flow if the management UI may have been reachable by untrusted parties, treating the secret as compromised.
   • Place the management interface behind a reverse proxy that enforces authentication for static asset paths and blocks /js/oidc-oauth/bootstrap.js from unauthenticated clients.
   • Monitor for and alert on unauthenticated access to /js/oidc-oauth/bootstrap.js.

2. Patch/upgrade steps:

   • Upgrade to RabbitMQ 4.3.3 or 4.2.9, versions in which this issue is fixed.
   • Upgrade dependent management plugin packages to matching fixed versions and restart the broker.
   • After upgrading, verify that the OAuth2 client secret is no longer returned by the unauthenticated bootstrap endpoint.

3. Long-term hardening:

   • Never expose the management UI directly to untrusted networks; use bastion hosts, VPN, or zero-trust access proxies.
   • Adopt secret management best practices (avoid placing secrets in client-served resources; keep secrets server-side).
   • Apply least-privilege OAuth2 scopes and short-lived tokens to limit the impact of any single credential compromise.
   • Continuously inventory broker management interfaces and integrate them into external attack-surface monitoring.

References

• NVD — CVE-2026-67410: https://nvd.nist.gov/vuln/detail/CVE-2026-67410
• RabbitMQ Security / Release Notes (Management UI): https://www.rabbitmq.com/release-information
• RabbitMQ OAuth 2.0 Authentication Documentation: https://www.rabbitmq.com/docs/oauth2
• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html

Note: No CISA KEV entry, public proof-of-concept, exploit code, or Nuclei template is available for this CVE. EPSS has not yet scored this CVE. No known threat actor campaigns or in-the-wild exploitation evidence is available at the time of writing.