CyberRota Analysis
AI-GeneratedRabbitMQ versions prior to 4.2.6 are vulnerable to a flaw that allows existing consumers to continue receiving messages even after their OAuth tokens expire or their scopes are reduced. This can lead to unauthorized access to messages, potentially compromising sensitive data. Organizations using RabbitMQ should prioritize upgrading to version 4.2.6 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expiry or connection.update_secret refresh to reduced scopes because existing consumers are not canceled or reauthorized at delivery time after the channel user state changes. This issue is fixed in version 4.2.6.
Related CVEs
Other vulnerabilities affecting the same vendor(s)