CVE-2026-9133

unknowncovered by 1 sourcefirst seen 2026-06-05

Bulletin ID: 2026-034-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 05/20/2026 12:45 PM PDT Description: rabbitmq-aws is a RabbitMQ plugin that resolves AWS ARNs in broker configuration at startup, fetching secrets (e.g., TLS certificates, private keys, passwords) from AWS services (Secrets Manager, S3, ACM Private CA) and passing them in-memory to RabbitMQ. We identified CVE-2026-9133, an active debug code issue in the plugin's ARN resolver. A debug ARN scheme (arn:aws-debug:file) accepted by the PUT /api/aws/arn/validate validation endpoint might allow remote authenticated users to perform arbitrary file reads on any file accessible to the RabbitMQ process. The debug code was inadvertently shipped in production builds with no mechanism to disable it. Impacted versions: >=0.1.0, <=0.2.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

CSIRTS triage

What: A debug code issue allows remote authenticated users to perform arbitrary file reads.
Who is affected: Users of the rabbitmq-aws plugin within the specified version range.
Urgency: Remediation is important due to the risk of sensitive information disclosure.
Action: Upgrade to a version outside the specified range.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2026-9133

Get an email if CVE-2026-9133 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all EPSS-scored CVEs.

Advisory coverage (1)

unknownCVE-2026-9133 - Arbitrary file read in rabbitmq-aws pluginaws · 2026-06-05

External references

NVD record for CVE-2026-9133

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-9133 status](https://www.csirts.com/badge/CVE-2026-9133)](https://www.csirts.com/cve/CVE-2026-9133)