Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1310 CNY

100%
Buy Us a Coffee

CVE-2026-9133— Arbitrary file read in rabbitmq-aws plugin

CVSS 7.7 · High EPSS 0.03% · P8

Affected Version Matrix 1

VendorProductVersion RangeStatus
AWSRabbitMQ AWS0.1.0≤ 0.2.0affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-9133

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Arbitrary file read in rabbitmq-aws plugin
Source: NVD (National Vulnerability Database)
Vulnerability Description
Active debug code exists in the ARN resolver of amazon-mq rabbitmq-aws before version 0.2.1. A debug ARN scheme (arn:aws-debug:file) accepted by the PUT /api/aws/arn/validate validation endpoint might allow remote authenticated users to perform arbitrary file reads on any file accessible to the RabbitMQ process. To remediate this issue, customers should upgrade to version 0.2.1 of rabbitmq-aws. If RabbitMQ is configured to use TLS for connections, we also recommend rotating any associated private certificate keys.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
遗留的调试代码
Source: NVD (National Vulnerability Database)
Vulnerability Title
RabbitMQ AWS infrastructure Plugin 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
RabbitMQ AWS infrastructure Plugin是amazon-mq开源的一个用于集成AWS基础设施的RabbitMQ插件。 RabbitMQ AWS infrastructure Plugin 0.2.1之前版本存在安全漏洞，该漏洞源于ARN解析器中存在调试代码，可能导致远程认证用户对RabbitMQ进程可访问的任何文件执行任意文件读取。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
AWSRabbitMQ AWS 0.1.0 ~ 0.2.0 -

II. Public POCs for CVE-2026-9133

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium
Qwen3.6-35B-A3B · 6367 chars
Paid plan includes:
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-9133

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-9133 (2)

Vendor Pages for CVE-2026-9133 (1)

IV. Related Vulnerabilities

Same vendor: AWS
Same weakness: CWE-489

V. Comments for CVE-2026-9133

No comments yet

Leave a comment