The security team at **Miggo** recently disclosed details of two critical access control flaws affecting the **RabbitMQ** message broker. These vulnerabilities, present since early 2024 (impacting release lines from 3.13.0 and later), could have severe implications for enterprise messaging infrastructure. ### Unauthenticated Secret Leak Leads to Full Takeover The first and most critical flaw, tracked as **CVE-2026-57219** (CVSS score: 8.7), involves an obsolete HTTP API endpoint (`GET /api/auth`). This endpoint was found to reveal the broker's confidential OAuth client secret to an unauthenticated attacker, provided **RabbitMQ** was configured to use the `management.oauth_client_secret` key.  **Miggo** highlighted that this vulnerability offers a direct path to a full broker takeover. An attacker could exchange the leaked secret for an administrator token, granting complete control over messages, queues, users, and broker settings. “The endpoint's authorization check was hard-coded to always allow the request, unlike every other sensitive management endpoint,” **Miggo** explained. “The risk is sharpest wherever the management port is reachable by an untrusted network: cloud or multi-tenant setups, or a management UI accidentally exposed to the internet.” ### Tenant Boundary Bypass for Authenticated Users The second vulnerability, **CVE-2026-57221** (CVSS score: 5.3), is an authorization bypass that allows any authenticated user connected to a virtual host to enumerate all queue and exchange names within that virtual host. This flaw also permits reading queue message counts and consumer counts, regardless of the user's actual permissions. ### Patching and Mitigation Strategies Both vulnerabilities have been addressed in **RabbitMQ** versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15. While there's no evidence of active exploitation prior to public disclosure, immediate patching is strongly advised for all affected instances.  In addition to patching, **Miggo** recommends several mitigation steps: * **Rotate the OAuth client secret** if the management interface is internet-reachable. * **Limit access to port 15672** to prevent the management interface from being exposed over the network. * **Separate tenants by virtual host** for enhanced isolation. * **Implement firewall rules** to block access to the vulnerable endpoint on unpatched instances. This disclosure follows recent fixes for other critical **RabbitMQ** vulnerabilities, including a **TLS client-authentication bypass** (CVSS score: 9.1) and a flaw allowing attackers to **forge JSON Web Key Set (JWKS) responses** (CVSS score: 9.2) in an adversary-in-the-middle (AitM) position, enabling the broker to accept arbitrary JWTs.