The issue is related to insufficient protection of service data in the RocketMQ messaging platform. This could allow a remote attacker to gain unauthorized access to protected information. Under certain conditions, even with authentication and authorization functions enabled, there is a risk of exposing sensitive information to an unauthorized actor. An attacker with regular user privileges or listed in the IP whitelist could potentially acquire the administrator's account and password through specific interfaces, granting them full control over RocketMQ if they have access to the broker IP address list.