In brief: CVE-2026-57219 exposes OAuth client secrets via an unprotected endpoint and enables complete takeover of the RabbitMQ broker.
Two security vulnerabilities in RabbitMQ threaten millions of deployments worldwide. They enable unauthenticated attackers to exfiltrate OAuth client secrets and gain complete control over the messaging infrastructure.
RabbitMQ versions 3.13.0 and later (from early 2024) are affected by two access control flaws discovered by Miggo Security. The message broker is downloaded over 15 million times per year and manages critical data streams in modern applications — orders, payments, authentication events, and internal notifications. Patches are available in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
The more critical vulnerability CVE-2026-57219 (CVSS 8.7) is based on a legacy management endpoint “GET /api/auth” that returned OAuth configuration including the client secret without authentication to any requester. Attackers with network access to the management interface can read out the secret and exchange it for an administrator token — in deployments with confidential OAuth clients (e.g., Microsoft Entra ID, Auth0, Keycloak, UAA), this leads to complete broker takeover. RabbitMQ fixes the issue by removing the obsolete endpoint and switching to an authenticated bootstrap mechanism that does not expose the client secret over HTTP.
The second vulnerability CVE-2026-57221 is an authorization bypass in passive queue and exchange declarations. Users with minimally privileged accounts can determine which queues and exchanges exist and read their metadata such as message counters and active consumers. This does not expose message contents but enables reconnaissance in shared-tenancy environments. The fix enforces the same authorization checks for passive declarations as for other operations.
Miggo recommends immediate updates, rotation of exposed OAuth secrets after patching, and isolation of the management interface from untrusted networks. For CVE-2026-57221, there is no WAF workaround; tenants should be distributed across separate virtual hosts until patching is complete.
Source: www.csoonline.com · Published 13 July 2026
Lumi AI News — AI-assisted curation in accordance with Article 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.