PT-2026-42261 · Amazon · Rabbitmq Aws

The-Mikedavis · CVE-2026-9133 · Published 2026-05-20 · Updated 2026-05-29

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions amazon-mq rabbitmq-aws versions prior to 0.2.1

Description Active debug code in the ARN resolver allows remote authenticated users to perform arbitrary file reads on any file accessible to the RabbitMQ process. This occurs because the 'PUT /api/aws/arn/validate' endpoint accepts a debug ARN scheme (arn:aws-debug:file).

Recommendations Upgrade to version 0.2.1. Rotate any associated private certificate keys if RabbitMQ is configured to use TLS for connections.

Exploit

Fix

Weakness Enumeration

CWE-489

Related Identifiers

CVE-2026-9133

GHSA-8554-WG4R-7HXM

Affected Products

Rabbitmq Aws

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9133.json · Exploit
• https://github.com/amazon-mq/rabbitmq-aws/releases/tag/0.2.1 · Patch
• https://aws.amazon.com/security/security-bulletins/2026-034-aws · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-9133 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-9133 · Security Note
• https://github.com/amazon-mq/rabbitmq-aws/security/advisories/GHSA-8554-wg4r-7hxm · Note
• https://reddit.com/r/tellerstech/comments/1tqnwp2/ship_it_weekly_podcast_github_supply_chain · Reddit Post
• https://t.me/CVEtracker/54435 · Telegram Post