RabbitMQ Flaws Open Broker Hijack Paths

A pair of severe access control vulnerabilities within the RabbitMQ message broker has surfaced, creating potential pathways for unauthorized actors to seize control of messaging infrastructure. The discovery highlights risks specifically tied to misconfigured OAuth implementations and weak tenant isolation protocols.

Unauthenticated Paths to Full Control

The first vulnerability, identified as CVE-2026-57219, carries a CVSS score of 8.7. It stems from an obsolete HTTP API endpoint that inadvertently exposes the client secret on installations where OAuth 2 is active. This flaw allows an unauthenticated actor to obtain an administrator token, granting them comprehensive control over queues, users, and broker settings.

The endpoint's authorization check was hard-coded to always allow the request, unlike every other sensitive management endpoint.

— Miggo, the security team that discovered and reported the flaws.

The impact is particularly acute in environments where the management port is accessible via an untrusted network, such as cloud deployments or multi-tenant architectures. Research indicates these issues have persisted in the codebase since early 2024.

Tenant Isolation and Data Exposure

The second vulnerability, CVE-2026-57221, holds a CVSS score of 5.3. This flaw results from a missing authorization check, which enables any authenticated user connected to a virtual host to enumerate queue and exchange names. Furthermore, users can read message and consumer counts despite not possessing the necessary permissions for such actions.

• CVE-2026-57219 carries a CVSS score of 8.7.
• CVE-2026-57221 carries a CVSS score of 5.3.
• Impacted RabbitMQ release lines date back to 3.13.0.
• Patches are now available in versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15.

Infrastructure Security Implications

Beyond these specific flaws, maintainers have addressed additional TLS client-authentication bypass issues and vulnerabilities that allow attackers to forge JSON Web Key Set (JWKS) responses. These incidents underscore the necessity of rigorous network hygiene for message brokers. For organizations relying on RabbitMQ, the risk profile suggests that failing to restrict access to management ports—such as port 15672—or neglecting to rotate OAuth client secrets on exposed instances could lead to full system compromise. Implementing strict firewall rules and proper virtual host separation remains critical to mitigating the potential for lateral movement within these messaging environments.