RabbitMQ CVE-2026-5721: Obsolete Endpoint Exposed OAuth Secret, Went Undetected

Miggo Security disclosed a critical flaw in RabbitMQ on July 13, 2026. RabbitMQ is the open-source message broker distributed by Broadcom through its Tanzu line. CVE-2026-5721 allows an unauthenticated attacker to retrieve the broker's OAuth client secret via an endpoint that remained active in the web management plugin after becoming obsolete. The vulnerability has existed in the code since its introduction in version 3.13.0 in early 2024. All technical details stem from Miggo Security's research; no official Broadcom/Tanzu advisory has been issued.

The Attack Chain: From Obsolete Endpoint to Administrative Token

The technical core of the vulnerability is an HTTP endpoint, GET /api/auth, residing in RabbitMQ's web management plugin. According to CSO Online citing Miggo Security's work, this endpoint returns the broker's OAuth configuration including the client secret without requiring any authentication. The secret, intended to be known only to the broker and the identity provider, becomes accessible to anyone who can reach the management port.

The attack chain documented by the researchers does not stop at secret exposure. Per a direct Miggo Security quote reported by HowToUseLinux, "anyone who could reach the management port could retrieve it, then, where the OAuth grant makes the secret usable, impersonate the broker at the identity provider and obtain an administrative token." The brief supports that the token obtained through the OAuth grant flow enables broker impersonation at the IdP; the source does not specify that this enables direct operations on the broker.

The affected configuration is one where RabbitMQ acts as a confidential OAuth 2.0/OIDC client, typical for standard providers such as Auth0, Azure AD/Entra ID, Keycloak, and UAA. Not all installations are exposed: systems lacking an enabled management plugin, or lacking a configured client secret, present no attack surface. Risk concentrates in cloud and multi-tenant deployments where the management interface is exposed to untrusted networks.

"None of these RabbitMQ bugs are exotic. They've sat in the codebase for over two years. They are exactly the kind of silent, systemic inconsistency that hides in mature, widely deployed software" — Miggo Security

Two Years of Exposure: The Risk of Systemic Inconsistencies

The duration of the exposure window, over two years, is the data point Miggo Security emphasizes as most significant from a process perspective. Version 3.13.0, which introduced the vulnerable code, was released in early 2024. Since then the broker has gone through multiple release cycles without the anomaly being detected by internal audits, community contributors, or automated analysis tools.

Miggo Security identified the flaw through its autonomous research platform, VulnHunter. Per DeafNews's interpretation, the nature of the bug — a functionally obsolete endpoint retaining access to sensitive cryptographic material — raises questions about the ability of traditional security scanning tools to detect architectural inconsistencies in mature codebases. The brief does not specify reasons why the vulnerability went undetected.

CSO Online noted that Broadcom/Tanzu, RabbitMQ's commercial distributor, did not respond to requests for comment on the advisory publication. The dossier does not specify the exact date of Miggo's report to project maintainers, nor the form of disclosure preceding the public announcement on July 13.

The Broker's Role in Software Architecture

Miggo researchers described RabbitMQ as "the plumbing that moves data between services inside modern applications: orders, payments, authentication events, internal notifications." This metaphor, reported by CSO Online, illustrates the broker's position in software architecture.

An attacker who obtains an administrative token through the CVE-2026-5721 chain gains the ability to impersonate the broker at the identity provider. The brief supports the capabilities to "impersonate the broker" and "obtain an admin token." The source does not specify further consequences on routing keys, bindings, or stream interception.

Immediate Actions

Priority actions for RabbitMQ infrastructure operators, derived from documented facts, are as follows:

• Verify the installed version and apply updates to patched releases: 4.3.0, 4.2.6, 4.1.11, 4.0.20, or 3.13.15, per The Cyber Express
• Confirm the management plugin is disabled where not essential, or that the management port is not exposed to untrusted networks
• Verify the presence of a configured OAuth client secret: systems without this configuration are not affected by the vulnerability
• Review management port access logs to identify anomalous requests to the /api/auth endpoint in the pre-patching period

The fix implemented by RabbitMQ, according to CSO Online, removed the obsolete endpoint and introduced an authenticated bootstrap mechanism for OAuth configuration.

Editorial Close

CVE-2026-5721 falls into a category of vulnerabilities security teams find particularly insidious: it requires no sophisticated exploit, depends on no race conditions or memory corruption, but exploits an endpoint that remained active beyond its functional utility. The fact it traversed over two years of releases undetected — in a project with over 15 million annual downloads per Miggo estimates — indicates a gap in architectural review process more than in conventional security testing.

The absence of an official advisory from Broadcom/Tanzu at the time of public disclosure leaves operators relying solely on Miggo Security's research for risk assessment. Cited sources are editorial and converge on the same research data.

Information has been verified against cited sources and is current as of publication.

Sources

• https://thecyberexpress.com/cve-2026-5721-rabbitmq-vulnerability/
• https://www.news4hackers.com/rabbitmq-critical-vulnerability-endangers-enterprise-systems
• https://www.csoonline.com/article/4196093/rabbitmq-flaws-expose-oauth-secrets-risk-complete-takeover-of-the-broker.html
• https://www.howtouselinux.com/post/critical-rabbitmq-flaw-hands-attackers-the-keys-to-the-broker-cve-2026-5721
• https://nvd.nist.gov/vuln/detail/CVE-2026-5721
• https://www.securityweek.com/rabbitmq-vulnerability-threatens-enterprise-systems/
• https://thecyberexpress.com/about-us/