Bottom line: Two access control flaws in RabbitMQ expose OAuth client secrets and enable reconnaissance via queue metadata; patches are available for versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
RabbitMQ has patched two access control vulnerabilities that jeopardize the widely used open-source message broker system. The flaws allow attackers to steal OAuth secrets and, in critical scenarios, assume complete control over the messaging infrastructure.
Miggo Security discovered and reported two critical security vulnerabilities in the RabbitMQ messaging system. RabbitMQ is downloaded more than 15 million times annually worldwide and serves as a central infrastructure component for data transport between microservices in enterprise applications—from order systems to payment processing to authentication events.
The more severe vulnerability is designated CVE-2026-57219 and received a CVSS score of 8.7. It stems from a deprecated management endpoint “GET /api/auth” that returned the broker’s OAuth client secret without authentication to any requesting user. In production environments using trusted OAuth clients with providers such as Microsoft Entra ID, Auth0, Keycloak, or UAA, an attacker could use the compromised secret to authenticate as an administrator and gain complete control over the broker. With such control, an attacker could access or manipulate messages, create new users, and alter broker configuration. RabbitMQ fixed the issue by removing the deprecated endpoint and switching to an authenticated bootstrap mechanism that no longer transmits the client secret over HTTP. Patches are available in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
The second flaw, CVE-2026-57221, is an authorization bypass in passive queue and exchange declaration operations. While valid access is required, accounts without assigned permissions are not checked. This enables attackers to determine whether specific queues and exchanges exist, as well as read metadata such as message counts and active consumers. In shared environments, this information can lead to reconnaissance of application topologies, workload activities, and other tenants sharing a virtual host. RabbitMQ fixed this error by ensuring passive declarations now undergo the same authorization checks as other operations. Since no WAF mitigation or configuration workaround exists, organizations are advised to patch immediately and, until suitable patches become available, isolate tenants into separate virtual hosts.
Miggo stated that the vulnerability was identified through its VulnHunter platform for autonomous security research, before being validated by its internal security team and reported to RabbitMQ maintainers at Broadcom’s Tanzu division. The maintainers confirmed the vulnerability and released patches. The flaws affect RabbitMQ versions from 3.13.0 onward from early 2024.
Source: www.csoonline.com · Published 13 July 2026
Lumi AI News — AI-assisted curation in accordance with Art. 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.