RabbitMQ flaw leaks OAuth secret, risks admin takeover

Cybersecurity firm Miggo disclosed a vulnerability in RabbitMQ’s management web interface that can reveal the broker’s OAuth client secret to unauthenticated users. The defect is tracked as CVE-2026-5721 and carries a CVSS score of 8.7.

The bug exists in an obsolete management endpoint that returns the OAuth secret without requiring authentication. It affects deployments where an administrator configured a confidential client secret for OAuth or OpenID Connect identity providers. Instances with no client secret or without the management plugin are not affected.

When the exposed secret is in use — the default for integrations with providers such as Auth0, Azure AD/Entra ID, Keycloak or UAA — an attacker who can reach the management port can impersonate the broker to the identity provider and request an administrator token. An administrator token would allow changes to users, messages, queues and broker settings.

Miggo wrote: “Anyone who could reach the management port could fetch it, then, where the OAuth grant makes the secret usable, impersonate the broker to the identity provider and obtain an administrator token.” The firm noted the risk is higher when the management port is reachable from an untrusted network, including cloud and multi-tenant environments or when the UI is exposed to the internet.

The vulnerable code was introduced in early 2024 in RabbitMQ version 3.13.0. RabbitMQ issued fixes in releases 4.3.0, 4.2.6, 4.1.11, 4.0.20 and 3.13.15.

The updates also address a separate issue, CVE-2026-57221, with a CVSS score of 5.3. That missing-authorization flaw allows any authenticated user to enumerate queues and exchanges and view their statistics. Miggo said the issue can be used to map virtual hosts and infer business activity in multi-tenant setups.

Organizations using RabbitMQ are advised to apply the available updates. Where patching is not immediately possible, administrators should block access to vulnerable instances, keep the management interface off the public internet, apply network segmentation and rotate OAuth client secrets. There is no public evidence that the flaws have been exploited in the wild.

RabbitMQ is an open source message broker that routes and buffers messages between applications. The management plugin supplies the web interface and API involved in the newly disclosed defects and their handling of authentication secrets.

The company added: “Neither of these RabbitMQ bugs is exotic. They sat in the codebase for over two years. They are precisely the kind of quiet, systemic inconsistency that hides in mature, widely deployed software.”