RabbitMQ OAuth Secret Disclosure Bug Exposes Brokers to Takeover

RabbitMQ has patched two vulnerabilities that could expose sensitive data and undermine tenant isolation in enterprise deployments. The most serious flaw, tracked as CVE-2026-57219 and reported by Miggo, allows an unauthenticated attacker to retrieve OAuth 2 configuration details, including a confidential client secret, from the obsolete /api/auth management endpoint. In deployments that use the management interface with OAuth-based identity provider authentication, an attacker could use the leaked secret to impersonate the broker, obtain an administrator token, and gain access to users, messages, queues, exchanges, and broker settings.

A second flaw, CVE-2026-57221, allows authenticated users without proper permissions to infer the existence of other tenants’ queues and exchanges and view related metadata and statistics, creating cross-tenant information leakage. The issues affect versions dating back to RabbitMQ 3.13.0 and have been fixed in 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15. Organizations are being urged to patch quickly, restrict or remove internet exposure of the management interface, apply segmentation or other configuration mitigations if patching is delayed, and rotate OAuth client secrets because software updates alone do not invalidate secrets that may already have been exposed.