Unauthenticated RabbitMQ OAuth leak lets attackers hijack the broker
RabbitMQ’s management endpoint exposed the OAuth client secret to anyone without authentication (CVE-2026-5721, CVSS 8.7). An attacker who grabs the secret can impersonate the broker to an identity provider and seize admin control over queues, messages, and users. Patching to v4.3.0 or later and locking down the management UI mitigates the risk.