A misconfigured RabbitMQ management endpoint allows unauthenticated attackers to retrieve the OAuth client secret, enabling full broker takeover. Cyber‑security firm Miggo rates the vulnerability at CVSS 8.7, warning of acute risk in cloud and multi‑tenant deployments.

Key Takeaways

  • Unauthenticated access to RabbitMQ’s management port can leak the OAuth client secret.
  • CVE-2026-5721 carries a CVSS score of 8.7, indicating high severity.
  • Enterprises must patch immediately, block external management access, and rotate OAuth secrets.

RabbitMQ is a widely‑used open‑source message broker that routes, buffers, and distributes messages for asynchronous application communication. Cyber‑security firm Miggo has uncovered a critical vulnerability (CVE‑2026‑5721) that allows attackers without any credentials to obtain the broker’s confidential OAuth secret, a flaw that scores 8.7 on the CVSS scale.

Technical Details

The defect resides in an obsolete endpoint of RabbitMQ’s management web interface. The endpoint returns the OAuth secret to any caller, regardless of authentication. When the broker is configured to authenticate against an identity provider—such as Auth0, Azure AD/Entra ID, Keycloak, or UAA—the leaked secret can be used to impersonate the broker, request an administrator token from the provider, and gain unrestricted control over users, messages, queues, and broker settings.

Affected Versions and Fixes

CVE‑2026‑5721 was introduced in early 2024 with RabbitMQ 3.13.0. It has been remediated in later releases: 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15. The same update series also patches CVE‑2026‑57221 (CVSS 5.3), a medium‑severity flaw that permits any authenticated user to enumerate queues and exchanges and read their statistics.

Business Impact

Deployments that do not configure a client secret, or that run without the management plugin, are not vulnerable. However, the risk spikes in cloud or multi‑tenant environments where the management port is reachable from an untrusted network. Miggo warns that the vulnerability can be leveraged to map an organization’s virtual hosts, infer business activity, and collect intelligence for future attacks, especially in shared‑resource scenarios.

Recommendations

Organizations should immediately upgrade RabbitMQ to a patched version. If immediate patching is impossible, they must block external access to the management interface, enforce network segmentation, ensure the UI is not exposed to the internet, and rotate the OAuth client secret. No public evidence of exploitation exists yet, but the potential impact warrants proactive mitigation.