CVE-2026-57218: Broadcom RabbitMQ Auth Bypass Vulnerability

CVE-2026-57218 Overview

CVE-2026-57218 is an authorization vulnerability [CWE-863] in RabbitMQ, the open-source messaging and streaming broker maintained by Broadcom. The flaw affects the AMQP 0-9-1 protocol implementation in versions prior to 4.2.6. Existing consumers continue receiving messages after an OAuth token expires or after a connection.update_secret refresh reduces the client's scopes. The RabbitMQ channel does not cancel or reauthorize established consumers when the user state changes, allowing continued delivery of messages the client should no longer access. Broadcom fixed the issue in RabbitMQ 4.2.6.

Critical Impact
An authenticated AMQP 0-9-1 consumer can continue receiving messages after its OAuth token expires or its permissions are downgraded, breaking scope enforcement guarantees.

Affected Products

Broadcom RabbitMQ Server versions prior to 4.2.6
AMQP 0-9-1 protocol consumers using OAuth 2.0 authentication
RabbitMQ deployments relying on connection.update_secret for scope changes

Discovery Timeline

2026-07-10 - CVE-2026-57218 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57218

Vulnerability Analysis

RabbitMQ uses AMQP 0-9-1 channels to broker message delivery between publishers and consumers. When a channel is created, the broker binds it to a user identity and caches permission checks for performance. Consumers subscribed on the channel receive messages as they arrive, without re-evaluating authorization on every delivery.

When an OAuth 2.0 token expires or a client issues connection.update_secret to refresh credentials with reduced scopes, RabbitMQ updates the internal user state on the channel. However, it does not cancel active consumer subscriptions or re-check whether those consumers still have permission to read from their bound queues. The permission cache retains the prior authorization decision.

The result is a scope enforcement gap. A consumer that legitimately subscribed under a broad scope keeps receiving messages after its token is downgraded or expired. This defeats the purpose of short-lived OAuth tokens and dynamic secret rotation in multi-tenant messaging environments.

Root Cause

The handle_info({update_user_state, User}, State) clause in rabbit_channel.erl updated the channel's user record but did not invalidate the permission cache or re-authorize existing consumers. Delivery continued to rely on stale authorization data cached at subscription time.

Attack Vector

Exploitation requires an authenticated AMQP 0-9-1 client that has established at least one consumer subscription. The attacker allows their OAuth token to expire, or the identity provider reduces their scopes and issues connection.update_secret. The client continues receiving messages from queues that its current token no longer authorizes. No additional network access or privilege escalation is required beyond the initial authenticated session.

text

// Patch: deps/rabbit/src/rabbit_channel.erl
// AMQP 0-9-1: clear permissions cache and re-check when secret changes
            Return
     end;
 handle_info({update_user_state, User}, State = #ch{cfg = Cfg}) ->
-    noreply(State#ch{cfg = Cfg#conf{user = User}}).
+    ok = clear_permission_cache(),
+    State1 = State#ch{cfg = Cfg#conf{user = User}},
+    noreply(recheck_consumers(State1)).


 handle_pre_hibernate(State0) ->

Source: rabbitmq-server commit db20d6c0

Detection Methods for CVE-2026-57218

Indicators of Compromise

AMQP 0-9-1 consumers that continue delivering messages after RabbitMQ logs record an OAuth token expiry event for the same connection.
connection.update_secret frames followed by continued basic.deliver traffic on queues that the new scope should not permit.
Long-lived consumer channels whose lifetime exceeds the configured OAuth token TTL without a reauthorization event.

Detection Strategies

Correlate RabbitMQ authentication logs with AMQP delivery telemetry to identify consumers active past token expiration.
Enable RabbitMQ audit logging for connection.update_secret and compare pre- and post-refresh consumer activity against expected scopes.
Inventory RabbitMQ deployments and confirm the installed version is 4.2.6 or later.

Monitoring Recommendations

Ship RabbitMQ broker logs and management API events to a centralized logging platform for correlation with identity provider token issuance and revocation events.
Alert on channels that remain in consuming state longer than the maximum OAuth token lifetime configured in the identity provider.
Track version metadata across all RabbitMQ nodes to detect unpatched brokers in clustered deployments.

How to Mitigate CVE-2026-57218

Immediate Actions Required

Upgrade all RabbitMQ Server nodes to version 4.2.6 or later, which contains the fix referenced in GHSA-wmrr-4h5v-5ch7.
Audit active AMQP 0-9-1 consumers and forcibly close long-lived channels bound to identities whose OAuth scopes have changed.
Review OAuth token TTL configuration and reduce lifetimes where operationally feasible until the upgrade is complete.

Patch Information

Broadcom released the fix in RabbitMQ v4.2.6. The change clears the permission cache and re-checks active consumers when the channel receives an update_user_state message. See the merged fixes in Pull Request #16092 and Pull Request #16097, along with the underlying commits 501ad947 and db20d6c0.

Workarounds

Terminate AMQP 0-9-1 connections at or before OAuth token expiry rather than relying on connection.update_secret to enforce scope reductions.
Configure clients to close and re-establish consumer subscriptions after any credential refresh so authorization is re-evaluated on subscription.
Restrict use of the AMQP 0-9-1 protocol in favor of AMQP 1.0 clients where feasible, since the flaw is scoped to the AMQP 0-9-1 channel handler.

bash

# Verify installed RabbitMQ version on each node
rabbitmqctl version

# Force-close a specific AMQP connection after credential change
rabbitmqctl close_connection "<connection_name>" "scope reduced, forcing reauth"

# List active consumers to audit for stale authorization state
rabbitmqctl list_consumers vhost queue_name channel_pid consumer_tag