RabbitMQ flaws leak the broker's OAuth secret and expose cross-tenant data

Researchers at Miggo disclosed two access-control flaws in RabbitMQ, the widely used message broker, that have been present since early 2024. In the more serious one, an obsolete management endpoint had its authorization check hard-coded to always allow, so an unauthenticated attacker can leak the broker's confidential OAuth client secret in a single request, a direct path to full broker takeover where that secret is used. The second lets any logged-in user, even one with no assigned permissions, read other tenants' queue and exchange metadata, useful reconnaissance in shared environments. Both are fixed in updated releases, and the risk is sharpest where the management port is reachable from untrusted networks.

Check

Identify RabbitMQ instances on affected 3.13 and later releases, check whether the management interface and port 15672 are reachable from untrusted networks, and confirm how the OAuth client secret is configured.

Affected

RabbitMQ deployments from release 3.13.0 onward (CVE-2026-57219, CVE-2026-57221), especially cloud or multi-tenant setups with the management port exposed; attackers can leak the OAuth secret or read other tenants' metadata.

Fix

Update to a fixed RabbitMQ release, rotate the OAuth client secret if the management interface was internet-reachable, restrict access to port 15672, separate tenants by virtual host, and firewall the vulnerable endpoint.