Critical RabbitMQ Flaw Lets Unauthenticated Attackers Take Over Message Brokers

Two critical access-control vulnerabilities have been uncovered in RabbitMQ, the world’s most widely deployed open-source message broker. Liad Eliyahu at Miggo found that one flaw allows unauthenticated attackers to steal a broker’s OAuth secret and seize full administrative control , while the other lets any logged-in user silently spy on other tenants’ data. Both have been patched following a coordinated disclosure with the maintainer, Michael Klishin.…