RabbitMQ: Two vulnerabilities that could expose OAuth secrets and queue metadata

Colleagues, I’d like to draw your attention to a cybersecurity update. RabbitMQ has two access-control vulnerabilities.

One issue, exposed via the legacy /api/auth endpoint, could reveal the OAuth client secret and create a path to broker compromise.

The second allows an authenticated user to read queue and exchange metadata belonging to other tenants.

Versions 3.13.0 and later are affected. Fixes are available in 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15.

I would recommend upgrading, rotating secrets, restricting access to port 15672, and isolating tenants by virtual host.

Why this matters: flaws in a message broker directly affect message access and infrastructure security.

How do you protect RabbitMQ in your environment?

#RabbitMQ #cybersecurity #Vulnerability #IAM