A critical vulnerability in RabbitMQ, a popular open-source message broker, has been discovered by cybersecurity firm Miggo. The flaw, tracked as CVE-2026-5721 (CVSS score of 8.7), allows attackers to obtain the broker’s confidential OAuth secret, potentially granting them access to sensitive data and systems.
The vulnerability affects RabbitMQ instances where the administrator has set up the broker’s confidential password for identity provider authentication. In such configurations, an attacker who can reach the management port can fetch the OAuth secret, which can then be used to impersonate the broker and obtain an administrator token. This token grants access to users, messages, queues, and broker settings, allowing attackers to gain control of critical systems.
The risk is particularly high in cloud or multi-tenant setups where the management port may be reachable by untrusted networks. In these environments, an attacker could use the exposed secret to map an organization’s virtual host, infer business activity, and gather intelligence for future attacks. Multi-tenant environments where multiple applications or teams share a single virtual host are also at risk.
The vulnerability was introduced in RabbitMQ version 3.13.0 in early 2024 and has been addressed in versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15. Organizations using affected versions should update their deployments immediately to prevent potential attacks.
It’s worth noting that the vulnerability was not discovered through a sophisticated exploit, but rather by identifying an open management endpoint that returns the OAuth secret without authentication. This highlights the importance of regular security audits and patching of software vulnerabilities.
In addition to updating RabbitMQ instances, organizations should also take steps to secure their systems. Blocking access to vulnerable instances if patching is not possible, ensuring the management interface is not exposed to the internet, implementing segmentation, and rotating the OAuth client secret are all recommended measures. While there is no evidence of in-the-wild exploitation of this vulnerability, it’s essential for organizations to take proactive steps to prevent potential attacks.
The discovery of this vulnerability serves as a reminder that even widely used software can harbor security flaws that go unnoticed for extended periods. It’s crucial for organizations to prioritize regular security audits and patching to ensure the integrity of their systems. By taking these measures, organizations can minimize the risk of falling victim to such vulnerabilities and protect sensitive data and systems from potential attacks.
Source: SecurityWeek — 2026-07-13