Amazon rabbitmq-aws 0.1.0 through 0.2.0 - Arbitrary File Read

Amazon rabbitmq-aws versions 0.1.0 through 0.2.0 contain active debug code in the ARN resolver. An authenticated RabbitMQ user with management API access can submit an arn:aws-debug:file ARN to the validation endpoint and read arbitrary files accessible to the RabbitMQ process. id: CVE-2026-9133...

RabbitMQ Management - OAuth 2 Client Secret Disclosure

RabbitMQ 3.13.15, 4.0.20, 4.1.11, and 4.2.6 contains an information disclosure caused by the obsolete GET /api/auth endpoint exposing OAuth 2 client secrets when management.oauthclientsecret is configured, letting unauthenticated attackers access sensitive credentials, exploit requires management...

wavecrack

Wavecrack Description A user-friendly Web interface to share an hashcat cracking box among multiple users with some pre-defined options. Screenshots The homepage Adding an hash to crack Seeing the results and some stats Outline This Web application can be used to launch asynchronous password crac...

solarflare

solarflare Credential Dumping Tool for SolarWinds Orion Blog post: https://malicious.link/post/2020/solarflare-release-password-dumper-for-solarwinds-orion/ Credit to @asolino, @gentilkiwi, and @skelsec for helping me figuring out DPAPI. ============================================ | Collecting...

CVE-2026-59271

A flaw was found in Spring AMQP. When the RabbitMQ management aliveness check fails, the configured administrator password is inadvertently embedded in cleartext within the generated exception message. This could allow an attacker with access to system logs or error reporting to obtain sensitive...

CVE-2026-106123

A flaw was found in the RabbitMQ Java client library, leading to information disclosure. When parsing of an Advanced Message Queuing Protocol AMQP Uniform Resource Identifier URI fails, the connection configuration loader includes the raw URI string in exception messages. If the URI contains...

CVE-2026-106122

A flaw was found in the RabbitMQ Java client library. A remote attacker capable of submitting Remote Procedure Call RPC messages with malformed UTF-8 character sequences can cause a Denial of Service DoS. When the client library decodes and re-encodes an invalid property string, it exceeds intern...

CVE-2026-106121

A flaw was found in the RabbitMQ Java client library. When parsing incoming JSON-formatted messages, the built-in parser fails to terminate correctly if an input ends abruptly within an unclosed string or comment. A remote attacker could send a specially crafted, truncated message to trigger an...

CLEANSTART-2026-ND67671 When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request

Security vulnerability affects the rabbitmq-cluster-operator package. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request...

CLEANSTART-2026-PH23926 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently

Security vulnerability affects the rabbitmq-cluster-operator package. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently...

CLEANSTART-2026-NH23437 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

Security vulnerability affects the rabbitmq-cluster-operator package. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing...

CLEANSTART-2026-UR29764 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

Security vulnerability affects the rabbitmq-cluster-operator package. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

CLEANSTART-2026-XV44707 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

Security vulnerability affects the rabbitmq-cluster-operator package. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the...

CLEANSTART-2026-XY43119 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the rabbitmq-messaging-topology-operator package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-CL45138 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the rabbitmq-messaging-topology-operator package. gRPC-Go is the Go language implementation of gRPC...

CLEANSTART-2026-HS63877 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the rabbitmq-messaging-topology-operator package. gRPC-Go is the Go language implementation of gRPC...

Photon OS 5.0: Rabbitmq PHSA-2026-5.0-91-0978

An update of the rabbitmq package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0978. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Rabbitmq PHSA-2026-5.0-92-0978

An update of the rabbitmq package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0978. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Medusa

Medusa Medusa is a cross-platform agent compatible with both Python 3.8 and Python 2.7. Installation To install Medusa, you'll need Mythic v3 installed on a remote computer. You can find installation instructions for Mythic at the Mythic project page. From the Mythic install root, run the command...

CVE-2019-11287

CVE-2019-11287: DoS via Heap Overflow in RabbitMQ Web Management Plugin Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is...