RabbitMQ, an open-source message broker, found a security vulnerability, CVE-2026-57219, that returns the OAuth secret key to anyone, even without authentication. If the system is configured to "confidential" OAuth setup and port 15672 is public, the attacker can send an HTTP request to an endpoint and make the identity provider give full administrative privileges to themselves with the client key, allowing the attacker to gain access to messages, delete queues, create new users, and so on. This vulnerability puts cloud setups and multi-tenant environments in the most danger. RabbitMQ came out with 5 patches that systems should immediately upgrade to, along with advising people to rotate their secret keys, lock down their dashboards, and separate tenants to avoid silent surveillance.