CVE-2026-9133 - Arbitrary file read in rabbitmq-aws plugin

Back Back to CVE browser

HIGH

Arbitrary file read in rabbitmq-aws plugin

Published May 20, 2026

8.3

HIGH

CVSS 4.0

EPSS 1.08%

Description

Active debug code exists in the ARN resolver of amazon-mq rabbitmq-aws before version 0.2.1. A debug ARN scheme (arn:aws-debug:file) accepted by the PUT /api/aws/arn/validate validation endpoint might allow remote authenticated users to perform arbitrary file reads on any file accessible to the RabbitMQ process.

To remediate this issue, customers should upgrade to version 0.2.1 of rabbitmq-aws. If RabbitMQ is configured to use TLS for connections, we also recommend rotating any associated private certificate keys.

Affected products

Vendor AWS Product RabbitMQ AWS Default
unaffected
- Version
  0.1.0
  Status
  affected
  Constraints
  <=0.2.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

AWS

RabbitMQ AWS

unaffected

Version	Status	Constraints
0.1.0	affected	<=0.2.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-489

References (4)

https://aws.amazon.com/security/security-bulletins/2026-034-aws/
vendor-advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-31181
Advisory
https://github.com/amazon-mq/rabbitmq-aws/releases/tag/0.2.1
patch
https://github.com/amazon-mq/rabbitmq-aws/security/advisories/GHSA-8554-wg4r-7hxm
third-party-advisory

Link	Providers	Tags
https://aws.amazon.com/security/security-bulletins/2026-034-aws/		vendor-advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-31181		Advisory
https://github.com/amazon-mq/rabbitmq-aws/releases/tag/0.2.1		patch
https://github.com/amazon-mq/rabbitmq-aws/security/advisories/GHSA-8554-wg4r-7hxm		third-party-advisory