RabbitMQ is a message broker used by many modern applications. It helps systems send messages to each other in a fast and organized way. However, two new security flaws have been found in RabbitMQ. These flaws could expose sensitive data and create risk for enterprise messaging systems. The two flaws are CVE-2026-57219 and CVE-2026-57221. Both are related to access control. This issue matters because RabbitMQ is often used in business systems, SaaS platforms, microservices, and internal services.

What Is RabbitMQ?

RabbitMQ is a message broker. It helps applications exchange messages through queues.

For example, an e-commerce system may use RabbitMQ to process orders. Payment, notification, and warehouse systems can exchange messages through queues.

This makes application workflows easier to manage. However, if access control is weak, internal data may become exposed.

Because of this, RabbitMQ security should be taken seriously.

Why These Flaws Matter

These flaws matter because they affect access control. In simple terms, RabbitMQ may not always limit access correctly.

If access control fails, a user may see data they should not access. In some cases, an attacker may also obtain an OAuth client secret.

An OAuth client secret is a sensitive credential. If it leaks, an attacker may use it to obtain a token and take over the broker.

Also, the second flaw can expose queue metadata. This may not include message content, but it can still reveal business information.

CVE-2026-57219: OAuth Secret Disclosure

CVE-2026-57219 has a CVSS score of 8.7. It is linked to an old RabbitMQ HTTP API endpoint.

The endpoint is GET /api/auth. In certain configurations, it can reveal the OAuth client secret.

The risk is serious. If an attacker gets the secret, they may exchange it for an administrator token.

After that, the attacker could gain control over messages, queues, users, and broker settings.

However, not every RabbitMQ setup is affected. The risk applies to installations that use OAuth 2 with the management.oauth_client_secret configuration key.

CVE-2026-57221: Queue Metadata Exposure

CVE-2026-57221 has a CVSS score of 5.3. It is caused by a missing authorization check.

The issue affects passive queue declaration and passive exchange declaration.

An authenticated user may see queue and exchange names in a virtual host. This can happen even when the user has very limited permissions.

The user may also see message counts and consumer counts for queues. This may sound minor, but it can still be sensitive.

For example, queue names such as orders, payments, or transactions may reveal business activity. Message counts may also show transaction volume and processing backlogs.

Impact on Multi-Tenant Environments

This flaw is especially important in multi-tenant environments. In these systems, several applications or customers may share one RabbitMQ setup.

If tenant boundaries are weak, one tenant may see metadata from another tenant. This can expose internal system structure.

Attackers may also use the data for reconnaissance. They can map queues, exchanges, and application workflows.

In other words, metadata can help attackers plan a larger attack.

Affected RabbitMQ Versions

These flaws affect RabbitMQ release lines from version 3.13.0 and later.

The fixes are available in RabbitMQ 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15.

Because of this, organizations should check their RabbitMQ versions as soon as possible.

If they use an affected version, patching should be a priority. This is especially true when the management interface is reachable from an untrusted network.

Has Exploitation Been Seen?

According to the report, there is no evidence of active exploitation before public disclosure.

Still, the risk should not be ignored. Once vulnerability details become public, attackers may start looking for unpatched systems.

Also, RabbitMQ often sits in the middle of important data flows. So, leaked access or metadata can affect business operations.

Recommended Mitigation Steps

The main step is to update RabbitMQ to a fixed version. This is the safest way to close the flaws.

After that, rotate the OAuth client secret if the management interface was exposed to the internet or another untrusted network.

Also, restrict access to port 15672. This port is commonly used for the RabbitMQ Management UI.

Use a firewall, VPN, or IP allowlist. Do not expose the management interface to the public internet.

For systems that cannot be patched right away, block access to the vulnerable endpoint. Also, separate tenants by using different virtual hosts.

Extra Tips for IT Teams

IT teams should create an inventory of all RabbitMQ servers. Then, they should check versions, active plugins, and OAuth settings.

Next, review whether the rabbitmq_management plugin is enabled. If it is not needed, disable it.

Also, audit users and permissions for every virtual host. Each application should only have the access it truly needs.

Access logs should also be reviewed. Look for suspicious requests to the management API or unusual login activity.

Key Takeaway

These RabbitMQ flaws show why access control matters in messaging systems.

CVE-2026-57219 can leak an OAuth client secret in certain setups. Meanwhile, CVE-2026-57221 can expose queue metadata to users who should not see it.

For this reason, organizations should update RabbitMQ quickly. They should also restrict the management UI, rotate secrets, and audit permissions.

In the end, RabbitMQ security is not only about message content. Metadata, credentials, and access settings must also be protected.

Source: https://thehackernews.com/2026/07/rabbitmq-flaws-could-leak-oauth-secrets.html