Critical RabbitMQ Vulnerability (CVE-2026-5721) Exposes OAuth Client Secrets A newly disclosed vulnerability in RabbitMQ, tracked as CVE-2026-5721, allows unauthenticated attackers to extract a broker’s confidential OAuth client secret, potentially enabling full administrative control over messaging infrastructure. The flaw, rated 8.7 (High) on the CVSS scale, stems from an exposed management endpoint in RabbitMQ’s web interface that returns the secret without authentication. The issue affects RabbitMQ versions 3.13.0 and later, introduced in early 2024, and is particularly dangerous in deployments using OAuth 2.0 or OpenID Connect (e.g., Auth0, Azure AD/Entra ID, Keycloak, or UAA). Exploitation could grant attackers admin-level access, allowing them to manipulate users, queues, messages, and broker configurations. Systems without a configured client secret or those not using the management plugin are unaffected. Security firm Miggo highlighted that the risk is highest when the management interface is exposed to untrusted networks, such as cloud or multi-tenant environments. Patches have been released in RabbitMQ versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15. The updates also address CVE-2026-57221 (CVSS 5.3), a medium-severity flaw allowing authenticated users to enumerate queues and exchanges, potentially aiding reconnaissance for future attacks especially in shared virtual host environments. While no active exploitation has been observed, Miggo noted that both vulnerabilities stem from long-standing code inconsistencies, underscoring risks in widely deployed software. Organizations are urged to patch affected systems and restrict management interface access.

Authentication service provider and Okta subsidiary Auth0 experienced a "security event" involving some of its code repositories. Its multiple code repository archives from 2020 and earlier (pre-dating Okta's February 2022 acquisition) were obtained by unknown means from its environment. The company hired a third-party cybersecurity forensics firm to investigate how the data was exfiltrated. The company also took "precautionary steps" to ensure that information bundled with the code could not be used in the future to hack into company and customer systems.