CVE-2026-9133 - Arbitrary file read in rabbitmq-aws plugin

unknownCVE-2026-9133

Bulletin ID: 2026-034-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 05/20/2026 12:45 PM PDT Description: rabbitmq-aws is a RabbitMQ plugin that resolves AWS ARNs in broker configuration at startup, fetching secrets (e.g., TLS certificates, private keys, passwords) from AWS services (Secrets Manager, S3, ACM Private CA) and passing them in-memory to RabbitMQ. We identified CVE-2026-9133, an active debug code issue in the plugin's ARN resolver. A debug ARN scheme (arn:aws-debug:file) accepted by the PUT /api/aws/arn/validate validation endpoint might allow remote authenticated users to perform arbitrary file reads on any file accessible to the RabbitMQ process. The debug code was inadvertently shipped in production builds with no mechanism to disable it. Impacted versions: >=0.1.0, <=0.2.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

CSIRTS triage

vendor: Amazon product: rabbitmq-aws plugin Information disclosureaffected: >=0.1.0, <=0.2.0

What: A debug code issue allows remote authenticated users to perform arbitrary file reads.
Who is affected: Users of the rabbitmq-aws plugin within the specified version range.
Urgency: Remediation is important due to the risk of sensitive information disclosure.
Action: Upgrade to a version outside the specified range.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch rabbitmq-aws plugin

Get an email when a new rabbitmq-aws plugin advisory drops — max one per day, one-click unsubscribe.

Details

Source: AWS Security Bulletins (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-06-05
Exploitation: Not in CISA KEV at last sync

Original advisory: https://aws.amazon.com/security/security-bulletins/rss/2026-034-aws/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-91330.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-9133	coverage & exploitation status	NVD · CVE.org

Recent advisories for - Arbitrary file

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2026-3576: The Planyo Online Reservation System plugin for WordPress is vulnerable to Server-Side Request …nvd · 2026-07-11
highCVE-2026-15338: The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclu…nvd · 2026-07-11
unknownCVE-2026-48127: Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.110.0, users without…nvd · 2026-07-10
unknownCVE-2026-41482: Frappe is a full-stack web application framework. Prior to 16.18.3, possible path traversal an…nvd · 2026-07-10
mediumCVE-2026-57211: RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the Rabbit…nvd · 2026-07-10
highCVE-2026-55229: Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.34.0, Gotenberg's /forms…nvd · 2026-07-10