PT-2026-42261 · Amazon · Rabbitmq Aws

The-Mikedavis · Published 2026-05-20 · Updated 2026-05-29 · CVE-2026-9133

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions amazon-mq rabbitmq-aws versions prior to 0.2.1

Description Active debug code in the ARN resolver allows remote authenticated users to perform arbitrary file reads on any file accessible to the RabbitMQ process. This occurs because the 'PUT /api/aws/arn/validate' endpoint accepts a debug ARN scheme (arn:aws-debug:file).

Recommendations Upgrade to version 0.2.1. Rotate any associated private certificate keys if RabbitMQ is configured to use TLS for connections.

Fix

Weakness Enumeration

CWE-489

Related Identifiers

CVE-2026-9133

Affected Products

Rabbitmq Aws

References · 6

• https://github.com/amazon-mq/rabbitmq-aws/releases/tag/0.2.1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-9133 · Security Note
• https://aws.amazon.com/security/security-bulletins/2026-034-aws · Vendor Advisory
• https://github.com/amazon-mq/rabbitmq-aws/security/advisories/GHSA-8554-wg4r-7hxm · Note
• https://reddit.com/r/tellerstech/comments/1tqnwp2/ship_it_weekly_podcast_github_supply_chain · Reddit Post
• https://t.me/CVEtracker/54435 · Telegram Post