A significant vulnerability in RabbitMQ, tracked as CVE-2026-5721, poses a critical risk by allowing attackers to access the broker's OAuth secret without authentication. The flaw, revealed by cybersecurity firm Miggo, affects configurations where the broker's password for identity provider authentication is set. The vulnerability has a CVSS score of 8.7 and is introduced in RabbitMQ version 3.13.0.
It can lead to unauthorized access to admin tokens and control over user accounts and broker settings, particularly in cloud and multi-tenant environments. Updates have been issued to rectify this flaw. Organizations are advised to patch their instances and restrict access to management interfaces immediately.