Security research firm Miggo disclosed on July 14, 2026 that an obsolete RabbitMQ management endpoint was handing out a broker’s confidential OAuth client secret to any unauthenticated visitor who asked for it, a single request away from full administrative control of every message, queue, and user on the broker.
The flaw, tracked as CVE-2026-57219 (CVSS 8.7), lived in the endpoint GET /api/auth inside RabbitMQ’s management web interface. According to Miggo, the vulnerable code hard-coded the endpoint to always permit access, then copied the operator’s configured oauth_client_secret directly into the JSON response. Where an operator had wired RabbitMQ into a confidential-client OAuth setup, the kind used with Auth0, Microsoft Entra ID, Keycloak, or Cloud Foundry UAA, an attacker could take that leaked secret straight to the identity provider and exchange it for an administrator token. A second, lower-severity flaw, CVE-2026-57221 (CVSS 5.3), let logged-in users with no assigned permissions enumerate queues and exchanges across a shared broker by exploiting a naming convention in the code that accidentally skipped an authorization check. Both bugs had been present since RabbitMQ 3.13.0 in early 2024 and are fixed in versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15; Miggo said it found no evidence either had been exploited before disclosure.
The original insight here is not the CVSS score, it is where the bug lived: an authentication configuration endpoint that outlived its own justification. RabbitMQ brokers sit inside the messaging layer of cloud applications, often carrying data between microservices that individually enforce access control, which makes the broker itself an easy blind spot in an otherwise locked-down architecture. CyberTech has tracked how OAuth-based trust relationships are becoming attackers’ preferred way into cloud environments, and a leaked client secret is the most direct version of that path: no phishing, no exploit chain, just a credential handed over on request. Security teams running RabbitMQ should patch to the fixed versions immediately, rotate any OAuth client secret that was ever reachable through an exposed management port, and keep the management interface (port 15672) off any network that isn’t already trusted.
Source: Miggo
