CVE

CVE-2026-9133

7.7

CVSShigh

Exploitable remotely over the internet · low-privilege account sufficient.

Description

Active debug code exists in the ARN resolver of amazon-mq rabbitmq-aws before version 0.2.1. A debug ARN scheme (arn:aws-debug:file) accepted by the PUT /api/aws/arn/validate validation endpoint might allow remote authenticated users to perform arbitrary file reads on any file accessible to the RabbitMQ process. To remediate this issue, customers should upgrade to version 0.2.1 of rabbitmq-aws. If RabbitMQ is configured to use TLS for connections, we also recommend rotating any associated private certificate keys.

Attack Vector

Network

Privileges Req.

Low

User Interaction

None

rabbitmq aws

Updated Nov 10, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~10 seconds

Amazon rabbitmq-aws 0.1.0 through 0.2.0 - Arbitrary File Read

Amazon rabbitmq-aws versions 0.1.0 through 0.2.0 contain active debug code in the ARN resolver. An authenticated RabbitMQ user with management API access can submit an arn:aws-debug:file ARN to the validation endpoint and read arbitrary files accessible to the RabbitMQ process. References: https://github.com/amazon-mq/rabbitmq-aws/security/advisories/GHSA-8554-wg4r-7hxm https://aws.amazon.com/security/security-bulletins/2026-034-aws/ https://nvd.nist.gov/vuln/detail/CVE-2026-9133 Remediation: Upgrade rabbitmq-aws to version 0.2.1 or later. If upgrading is not immediately possible, disable the aws plugin and rotate secrets stored in files that the RabbitMQ process could read.

Used 20 times · 10 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: rabbitmq aws

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →