What is the CVSS score of CVE-2026-57211?

CVE-2026-57211 has a contested CVSS base score of 10.0 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of RabbitMQ are affected by CVE-2026-57211?

RabbitMQ's Windows-based message brokers (versions 4.1.0-4.1.10 and 4.2.0-4.2.5) face credential theft risk from a critical vulnerability in the management plugin that could enable attackers to…. A patch is available.

How to fix or mitigate CVE-2026-57211?

Within 24 hours, audit all Windows-deployed RabbitMQ installations to identify instances running affected versions (4.1.0-4.1.10 or 4.2.0-4.2.5) with multiple management extension plugins enabled. Within 7 days, upgrade all affected instances to patched versions 4.1.11 or 4.2.6 respectively, testing in non-production environments first to ensure compatibility with existing message flows. Within 30 days, complete deployment of patches across all RabbitMQ Windows systems and verify that management plugin configurations are reviewed for necessity of multiple extension plugins.

RabbitMQ CVE-2026-57211

EUVD-2026-43016 CRITICAL

Absolute Path Traversal (CWE-36)

2026-07-10 GitHub_M

Microsoft Information Disclosure Rabbitmq Server Red Hat

Critical

Disputed · 10.0 NVD

Severity by source

Sources disagree (Medium–Critical)

Vendor (GitHub_M) PRIMARY

MEDIUM

qualitative

NVD

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

5.9 MEDIUM

Remote unauthenticated static handler (AV:N/PR:N/UI:N) but gated by Windows plus non-default multi-plugin config (AC:H); impact is DNS/SMB coercion and NetNTLM leak, so C:H with no integrity, availability, or scope change.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

10.0 CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 13, 2026 - 22:59 vuln.today

v3 (cvss_changed)

Source Code Evidence Fetched

Jul 13, 2026 - 22:59 vuln.today

Analysis Updated

Jul 13, 2026 - 22:59 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 13, 2026 - 22:52 vuln.today

cvss_changed

Severity Changed

Jul 13, 2026 - 22:52 NVD

MEDIUM CRITICAL

CVSS changed

Jul 13, 2026 - 22:52 NVD

6.5 (MEDIUM) 10.0 (CRITICAL)

Patch available

Jul 10, 2026 - 22:02 EUVD

Analysis Generated

Jul 10, 2026 - 21:50 vuln.today

CVE Published

Jul 10, 2026 - 20:16 cve.org

MEDIUM 6.5

DescriptionNVD

RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbit_mgmt_wm_static can pass URL-encoded backslashes to erl_prim_loader:read_file_info before path validation when multiple management extension plugins are enabled, causing outbound DNS and SMB requests to attacker-controlled UNC paths. This issue is fixed in versions 4.1.11 and 4.2.6.

AnalysisAI

Server-side request forgery and NTLM credential exposure in the RabbitMQ management plugin (versions 4.1.0 to before 4.1.11 and 4.2.0 to before 4.2.6) on Windows lets remote actors coerce the broker into outbound DNS and SMB connections to attacker-controlled UNC paths. The static file handler rabbit_mgmt_wm_static passes URL-encoded backslashes to erl_prim_loader:read_file_info before path validation, but only when multiple management extension plugins are enabled. No public exploit has been identified at time of analysis, and the EPSS score is low (0.28%, 20th percentile) despite the CVSS 10.0 rating.

Technical ContextAI

RabbitMQ is an Erlang-based messaging and streaming broker; its optional management plugin exposes an HTTP UI and API served through the Cowboy web server. The affected component, rabbit_mgmt_wm_static.erl, serves static assets and uses Erlang's erl_prim_loader:read_file_info/1 (chosen because assets may live inside compressed .ez archives) rather than the normal file module. The root cause is CWE-36 (Absolute Path Traversal): URL-encoded backslashes in the request path were joined into a filename and handed to the primitive loader before any path validation ran. On Windows, a segment such as \\attacker.example.com\share is interpreted as a UNC path, so the file-info lookup triggers an outbound DNS resolution and SMB/CIFS connection to the attacker's host. The upstream fix (PR #15803) adds a validate_path_info/validate_segment guard that rejects any segment containing a forward slash, backslash, or NUL byte, and rejects '.' and '..' segments, mirroring cowboy_static's internal checks but running before erl_prim_loader is invoked. The affected CPE is cpe:2.3:a:rabbitmq:rabbitmq-server.

RemediationAI

Vendor-released patch: upgrade to RabbitMQ 4.1.11 or 4.2.6 (or later), as delivered in commits 39c3a8e9c71da0403d8dfc13f700e60c936e3682 and 6730797f6a34b4e8308cea60adf1243857e70204 and PR https://github.com/rabbitmq/rabbitmq-server/pull/15803, with the fixed 4.2.6 release at https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6 and details in advisory https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-7v84-m3g5-vxq6. If immediate patching is not possible, the exploit path requires multiple management extension plugins enabled, so disabling non-essential management extension plugins removes the precondition at the cost of losing those UI/API features; additionally restrict network access to the management HTTP listener (default TCP 15672) to trusted administrative networks, and block outbound SMB (TCP 445) and unnecessary DNS egress from the RabbitMQ Windows host to stop UNC callbacks and NetNTLM leakage, accepting that egress filtering may affect other host functions. Enforcing SMB signing and disabling NTLM where feasible further limits relay impact.