{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-57218", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-24T02:21:33.810Z", "datePublished": "2026-07-10T20:21:30.331Z", "dateUpdated": "2026-07-13T18:55:32.041Z"}, "containers": {"cna": {"title": "RabbitMQ: AMQP 0-9-1 in combination with OAuth 2: consumer persistence can lead to post-revocation message disclosure", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-wmrr-4h5v-5ch7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-wmrr-4h5v-5ch7"}, {"name": "https://github.com/rabbitmq/rabbitmq-server/pull/16092", "tags": ["x_refsource_MISC"], "url": "https://github.com/rabbitmq/rabbitmq-server/pull/16092"}, {"name": "https://github.com/rabbitmq/rabbitmq-server/pull/16097", "tags": ["x_refsource_MISC"], "url": "https://github.com/rabbitmq/rabbitmq-server/pull/16097"}, {"name": "https://github.com/rabbitmq/rabbitmq-server/commit/501ad947cd6bbcc9486fe96e0d073992bfe52cc4", "tags": ["x_refsource_MISC"], "url": "https://github.com/rabbitmq/rabbitmq-server/commit/501ad947cd6bbcc9486fe96e0d073992bfe52cc4"}, {"name": "https://github.com/rabbitmq/rabbitmq-server/commit/db20d6c0fcf3056030f244b5adab0d45c0db0c9e", "tags": ["x_refsource_MISC"], "url": "https://github.com/rabbitmq/rabbitmq-server/commit/db20d6c0fcf3056030f244b5adab0d45c0db0c9e"}, {"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"}], "affected": [{"vendor": "rabbitmq", "product": "rabbitmq-server", "versions": [{"version": ">= 4.2.0, < 4.2.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-10T20:21:30.331Z"}, "descriptions": [{"lang": "en", "value": "RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expiry or connection.update_secret refresh to reduced scopes because existing consumers are not canceled or reauthorized at delivery time after the channel user state changes. This issue is fixed in version 4.2.6."}], "source": {"advisory": "GHSA-wmrr-4h5v-5ch7", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-wmrr-4h5v-5ch7", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-13T18:17:14.739053Z", "id": "CVE-2026-57218", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-13T18:55:32.041Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-57218", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-13T18:17:14.739053Z"}}}], "references": [{"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-wmrr-4h5v-5ch7", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-13T18:17:26.365Z"}}], "cna": {"title": "RabbitMQ: AMQP 0-9-1 in combination with OAuth 2: consumer persistence can lead to post-revocation message disclosure", "source": {"advisory": "GHSA-wmrr-4h5v-5ch7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "rabbitmq", "product": "rabbitmq-server", "versions": [{"status": "affected", "version": ">= 4.2.0, < 4.2.6"}]}], "references": [{"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-wmrr-4h5v-5ch7", "name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-wmrr-4h5v-5ch7", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/rabbitmq/rabbitmq-server/pull/16092", "name": "https://github.com/rabbitmq/rabbitmq-server/pull/16092", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rabbitmq/rabbitmq-server/pull/16097", "name": "https://github.com/rabbitmq/rabbitmq-server/pull/16097", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rabbitmq/rabbitmq-server/commit/501ad947cd6bbcc9486fe96e0d073992bfe52cc4", "name": "https://github.com/rabbitmq/rabbitmq-server/commit/501ad947cd6bbcc9486fe96e0d073992bfe52cc4", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rabbitmq/rabbitmq-server/commit/db20d6c0fcf3056030f244b5adab0d45c0db0c9e", "name": "https://github.com/rabbitmq/rabbitmq-server/commit/db20d6c0fcf3056030f244b5adab0d45c0db0c9e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6", "name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expiry or connection.update_secret refresh to reduced scopes because existing consumers are not canceled or reauthorized at delivery time after the channel user state changes. This issue is fixed in version 4.2.6."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-10T20:21:30.331Z"}}}, "cveMetadata": {"cveId": "CVE-2026-57218", "state": "PUBLISHED", "dateUpdated": "2026-07-13T18:55:32.041Z", "dateReserved": "2026-06-24T02:21:33.810Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-10T20:21:30.331Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{}

{"bugzilla": {"description": "rabbitmq-server: RabbitMQ: Information disclosure due to improper consumer reauthorization", "id": "2499212", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499212"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-1220", "details": ["RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expiry or connection.update_secret refresh to reduced scopes because existing consumers are not canceled or reauthorized at delivery time after the channel user state changes. This issue is fixed in version 4.2.6.", "A flaw was found in RabbitMQ. An existing consumer in RabbitMQ AMQP 0-9-1 can continue to receive messages even after its OAuth token has expired or its connection's scopes have been reduced. This occurs because consumers are not properly canceled or reauthorized when the channel user state changes, potentially leading to unauthorized information disclosure."], "name": "CVE-2026-57218", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "impact": "moderate", "package_name": "rabbitmq-server4.2", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "impact": "moderate", "package_name": "rabbitmq-server4.3", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Not affected", "package_name": "rabbitmq-server", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Not affected", "package_name": "rabbitmq-server", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Not affected", "package_name": "rabbitmq-server", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-07-10T20:21:30Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-57218\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-57218\nhttps://github.com/rabbitmq/rabbitmq-server/commit/501ad947cd6bbcc9486fe96e0d073992bfe52cc4\nhttps://github.com/rabbitmq/rabbitmq-server/commit/db20d6c0fcf3056030f244b5adab0d45c0db0c9e\nhttps://github.com/rabbitmq/rabbitmq-server/pull/16092\nhttps://github.com/rabbitmq/rabbitmq-server/pull/16097\nhttps://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6\nhttps://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-wmrr-4h5v-5ch7"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.2.0,4.2.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "rabbitmq-server", "source": "cna", "vendor": "rabbitmq"}, "product": "rabbitmq-server", "vendor": "rabbitmq"}], "created": "2026-07-10T22:30:04.414648+00:00", "updated": "2026-07-28T08:15:06.237490+00:00", "vendors": ["rabbitmq", "rabbitmq$PRODUCT$rabbitmq-server"]}