A stale RabbitMQ management endpoint can hand out the broker’s OAuth secret to an unauthenticated caller. That turns a management leak into identity-provider impersonation, so patching only the broker does not help if the secret was already exposed.
Miggo mapped the flaws to CVE-2026-57219 and CVE-2026-57221. The first can leak the OAuth client secret in one request and the second lets any logged-in user read other tenants’ queue and exchange names, plus message and consumer counts. Fixed releases are 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15.
The sharpest exposure is on internet-reachable, cloud, or multi-tenant management ports. If the management interface uses shared OAuth trust, treat a leaked client secret as a takeover path, not just a configuration issue.