# RabbitMQ Flaws Could Expose OAuth Secrets and Cross-Tenant Data Two critical vulnerabilities put multi-tenant messaging systems at risk. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-07-14 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/63cc8a7a-4fd5-4e58-8a2b-086c7400b8a4 ## Critical Vulnerabilities in RabbitMQ Two security flaws discovered in RabbitMQ message broker service could lead to OAuth client secrets leakage and unauthorized access to multi-tenant data. CVE-2026-57219 with CVSS 8.7 allows unauthenticated attackers to gain full broker control, while CVE-2026-57221 (CVSS 5.3) enables authenticated users to bypass tenant boundaries and access sensitive queue metadata. ## OAuth Secrets Exposure Risk The first vulnerability found by Miggo's team exposes client secrets through an obsolete HTTP API endpoint (/api/auth) in OAuth 2 configured systems. Attackers can exchange these secrets for admin tokens to gain complete control over messages, user data and broker settings. Present since early 2024, this flaw poses particularly high risk in cloud environments. ## Cross-Tenant Data Breach Potential The second vulnerability (CVE-2026-57221) allows any authenticated user to list all queue/exchange names and read message counts within their virtual host, despite permission restrictions. This hard-coded authorization bypass creates significant data privacy risks for organizations using shared infrastructure, potentially exposing sensitive inter-tenant communications. ## Affected Versions and Patches The flaws impact RabbitMQ versions 3.13.0 and later, with fixes available in 4.3.0, 4.2.6, 4.1.11, 4.0.20 and 3.13.15. Security teams recommend rotating OAuth client secrets, restricting access to port 15672, enforcing strict virtual host separation, and implementing firewall rules for unpatched instances where the management interface is internet-accessible. ## Connection to Previous Critical Flaws These vulnerabilities follow two critical flaws (CVSS 9.1 and 9.2) patched by RabbitMQ last month, which allowed TLS client authentication bypass and acceptance of forged JWTs. The consecutive security issues highlight the importance of rigorous security audits for message broker systems handling sensitive enterprise communications. ## Enterprise Infrastructure Risks The RabbitMQ vulnerabilities pose serious threats to industries handling sensitive data like finance, healthcare and government. Unpatched systems risk message queue takeovers and confidential data leaks. Security teams must apply urgent mitigations and implement additional controls in multi-tenant architectures to prevent potential breaches through these attack vectors. ## Sources covering this story - https://thehackernews.com/2026/07/rabbitmq-flaws-could-leak-oauth-secrets.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._