TLDR Tech / InfoSec
Full Broker Takeover, No Login Required: Miggo Discovers Critical RabbitMQ Vulnerabilities Putting Application Data at Risk
Miggo's research team found two RabbitMQ bugs introduced in 3.13.0 that let attackers either grab an OAuth client secret without logging in or map tenant queues using a zero‑permission account. The first flaw exposes the broker's OAuth secret via an unauthenticated /api/auth endpoint, allowing full admin takeover wherever that secret is used with common IdPs. The second lets any logged‑in user passively declare queues and read stats across a shared virtual host. Operators should upgrade to the listed fixed releases, rotate OAuth secrets, lock down port 15672, and separate tenants by vhost.
Read the full story