Critical RabbitMQ Vulnerability (CVE-2026-5721) Exposes OAuth Client Secrets A newly disclosed vulnerability in RabbitMQ, tracked as CVE-2026-5721, allows unauthenticated attackers to extract a broker’s confidential OAuth client secret, potentially enabling full administrative control over messaging infrastructure. The flaw, rated 8.7 (High) on the CVSS scale, stems from an exposed management endpoint in RabbitMQ’s web interface that returns the secret without authentication. The issue affects RabbitMQ versions 3.13.0 and later, introduced in early 2024, and is particularly dangerous in deployments using OAuth 2.0 or OpenID Connect (e.g., Auth0, Azure AD/Entra ID, Keycloak, or UAA). Exploitation could grant attackers admin-level access, allowing them to manipulate users, queues, messages, and broker configurations. Systems without a configured client secret or those not using the management plugin are unaffected. Security firm Miggo highlighted that the risk is highest when the management interface is exposed to untrusted networks, such as cloud or multi-tenant environments. Patches have been released in RabbitMQ versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15. The updates also address CVE-2026-57221 (CVSS 5.3), a medium-severity flaw allowing authenticated users to enumerate queues and exchanges, potentially aiding reconnaissance for future attacks especially in shared virtual host environments. While no active exploitation has been observed, Miggo noted that both vulnerabilities stem from long-standing code inconsistencies, underscoring risks in widely deployed software. Organizations are urged to patch affected systems and restrict management interface access.