RabbitMQ Flaws Could Leak OAuth Secrets and Expose Cross-Tenant Queue Metadata

Cybersecurity researchers have disclosed two access control-related flaws impacting the RabbitMQ message broker service. Miggo’s security team discovered and reported these vulnerabilities, which could allow attackers to leak OAuth client secrets, expose enterprise messaging infrastructure to takeover risks, and bypass tenant boundaries. One vulnerability, CVE-2026-57219 (CVSS score: 8.7), exposes the broker’s confidential OAuth secret to an unauthenticated attacker in a single request, a direct path to full broker takeover in configurations that use that secret. The second vulnerability, CVE-2026-57221 (CVSS score: 5.3), allows any logged-in user to silently read other tenants’ data by enumerating queue and exchange names and reading queue message counts and consumer counts, regardless of their actual permissions. The endpoint’s authorization check was hard-coded to always allow the request, unlike every other sensitive management endpoint. The risk is sharpest wherever the management port is reachable by an untrusted network: cloud or multi-tenant setups, or a management UI accidentally exposed to the internet. Besides patching to the latest versions, it’s advised to rotate the OAuth client secret if the management interface is reachable over the internet, limit access to port 15672 to prevent the management interface from being reachable over the network, separate tenants by virtual host, and implement firewall rules to block access to the vulnerable endpoint on unpatched instances. The disclosure comes as RabbitMQ maintainers addressed two critical-severity flaws that could result in a TLS client-authentication bypass (CVSS score: 9.1) and allow an attacker in an adversary-in-the-middle (AitM) position to forge JSON Web Key Set (JWKS) responses and cause the broker to accept arbitrary JWTs (CVSS score: 9.2).