Multiple security vulnerabilities have been identified in RabbitMQ message broker service that could allow attackers to leak OAuth client secrets, expose enterprise messaging infrastructure to takeover risks, and bypass tenant boundaries. The flaws impact RabbitMQ release lines from 3.13.0 and later. They have been addressed in versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15.
CVE-2026-57219 (CVSS 8.7) - An obsolete HTTP API endpoint ("") that reveals client secret on RabbitMQ installations that had OAuth 2 configured to use the management.oauth_client_secret configuration key, allowing an attacker to exchange it for an administrator token and obtain full control of every message, queue, user, and broker setting.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in RabbitMQ message broker service that could allow attackers to leak OAuth client secrets, expose enterprise messaging infrastructure to takeover risks, and bypass tenant boundaries. The flaws impact RabbitMQ release lines from 3.13.0 and later. They have been addressed in versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15.
CVE-2026-57219 (CVSS 8.7) - An obsolete HTTP API endpoint ("") that reveals client secret on RabbitMQ installations that had OAuth 2 configured to use the management.oauth_client_secret configuration key, allowing an attacker to exchange it for an administrator token and obtain full control of every message, queue, user, and broker setting.[emaillocker id="1283"]
CVE-2026-57221 (CVSS 5.3) - A missing authorization that allows any authenticated user who can connect to a virtual host to enumerate all queue and exchange names in that virtual host and read queue message counts and consumer counts, regardless of their actual permissions. These vulnerabilities collectively present significant takeover risks for RabbitMQ installations with exposed management interfaces or cloud/multi-tenant setups. Administrators should patch to the latest versions and rotate OAuth client secrets if exposed over the internet. These vulnerabilities collectively present significant takeover risks for RabbitMQ installations with exposed management interfaces or cloud/multi-tenant setups.
These vulnerabilities collectively present significant takeover risks for RabbitMQ installations with exposed management interfaces or cloud/multi-tenant setups.
We recommend you to update RabbitMQ to version 4.3.0, 4.2.6, 4.1.11, 4.0.20, or 3.13.15.
The following reports contain further technical details:
[/emaillocker]