RabbitMQ Flaws Could Leak OAuth Secrets and Expose Cross-Tenant Queue Metadata

Summary: Miggo researchers disclosed two access control flaws in RabbitMQ, present in the codebase since early 2024 and affecting release lines from 3.13.0 onward, one of which leaks the broker's confidential OAuth secret to an unauthenticated attacker in a single request. The flaws were fixed in versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15, with no evidence of active exploitation before public disclosure.
Key Takeaway: One request from an unauthenticated attacker can hand over the OAuth secret that leads to full broker takeover wherever the management port is reachable from an untrusted network, and the second flaw lets any logged-in user silently read other tenants' queue data.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-57219
Related: ⚡ Weekly Recap: Word Press RCE, Sonic Wall 0-Days, AI Service Attacks, Share Point 0-Day and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026