Security researchers have disclosed two access control vulnerabilities in the RabbitMQ message broker service that could allow attackers to leak OAuth client secrets and bypass tenant boundaries. The flaws affect the widely used open-source message broker, which serves as critical infrastructure in many enterprise environments.
Discovered by Miggo’s security team, the first vulnerability leaks the broker’s confidential OAuth configuration, including client secrets that could enable attackers to authenticate as legitimate services. This could allow unauthorised access to messaging queues and the data flowing through them.
The second flaw involves tenant boundary bypass, where an attacker could access queue metadata belonging to other tenants in a multi-tenant RabbitMQ deployment. This cross-tenant information disclosure could expose sensitive operational data about other organisations using the same broker infrastructure.
RabbitMQ is used extensively in enterprise environments for asynchronous communication between microservices, event-driven architectures, and task queue management. Its widespread adoption means that vulnerabilities in the platform can have broad implications across industries.
The researchers reported the flaws to the RabbitMQ maintainers, who have released patches or mitigation guidance. Organisations running RabbitMQ are advised to update to the latest version and review their access control configurations, particularly for deployments that use OAuth-based authentication.
