Insufficient Session Expiration in RabbitMQ Server - #VU150997
Published: September 18, 2026
Vulnerability identifier: #VU150997
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-613
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose message payloads.
The vulnerability exists due to insufficient session expiration in the RabbitMQ native STOMP adapter when delivering messages to an existing subscription after OAuth JWT expiration. A remote user can retain a STOMP subscription established with a valid JWT past its expiration to disclose message payloads.
The JWT must have read permission for the subscribed queue before it expires.
Affected software
RabbitMQ Server
Remediation
Install security update from vendor's website.
RabbitMQ Server - addressed in versions 4.2.11, 4.3.6