Skip to main content

RabbitMQ CVE-2026-57216

| EUVDEUVD-2026-43019 CRITICAL
Improper Authentication (CWE-287)
2026-07-10 GitHub_M
Authentication Bypass Rabbitmq Server Suse Red Hat
Critical
Disputed · 10.0 NVD
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (GitHub_M) PRIMARY
MEDIUM
qualitative
NVD
10.0 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
8.1 HIGH

AC:H because exploitation needs a non-default PROXY-protocol path plus loopback-bound listener; PR:N since the default guest/guest account is effectively unauthenticated; full broker access gives C/I/A:H, scope unchanged.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.8 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Red Hat
6.3 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

8
Analysis Updated
Jul 13, 2026 - 21:29 vuln.today
v3 (cvss_changed)
Source Code Evidence Fetched
Jul 13, 2026 - 21:28 vuln.today
Analysis Updated
Jul 13, 2026 - 21:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 13, 2026 - 21:22 vuln.today
cvss_changed
Severity Changed
Jul 13, 2026 - 21:22 NVD
MEDIUM CRITICAL
CVSS changed
Jul 13, 2026 - 21:22 NVD
6.8 (MEDIUM) 10.0 (CRITICAL)
Patch available
Jul 10, 2026 - 22:02 EUVD
Analysis Generated
Jul 10, 2026 - 21:58 vuln.today

DescriptionNVD

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication can allow a loopback-restricted user such as guest to connect remotely when traffic is accepted through a trusted PROXY-protocol path and the backend listener is loopback-bound because the loopback check uses the listener-side socket address instead of the real client source. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

AnalysisAI

Authentication bypass in RabbitMQ (broker versions prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6) lets a loopback-restricted account such as the default guest user authenticate from a remote network when the broker sits behind a trusted PROXY-protocol path and the backend listener is loopback-bound. Because the loopback check evaluates the listener-side socket address (which appears as 127.0.0.1 to the local proxy) instead of the real client source carried in the PROXY header, the 'local only' restriction on guest is silently defeated across AMQP 0-9-1, AMQP 1.0, and the Stream Protocol. SSVC records a proof-of-concept; there is no CISA KEV listing and EPSS is low (0.34%, 26th percentile), indicating the flaw is potent but not yet mass-exploited.

Technical ContextAI

RabbitMQ is an Erlang-based message broker implementing AMQP 0-9-1, AMQP 1.0, MQTT, and its native Stream Protocol. By default the guest account is a 'loopback user' - RabbitMQ permits it to authenticate only over local connections via rabbit_access_control:check_user_loopback/2. The vulnerability (CWE-287, Improper Authentication) is a source-address confusion: the loopback determination was performed on the TCP socket's local/peer address as seen by the listener rather than on the real client IP. When PROXY protocol (proxy_protocol = true) is enabled and the actual TCP connection originates from a trusted local proxy or load balancer bound to loopback, the socket address read is 127.0.0.1, so the check passes even though the true client (conveyed in the PROXY protocol preamble as peer_host) is remote. The upstream fix in rabbit_amqp_reader.erl and rabbit_reader.erl changes the check to use the parsed PeerHost value instead of the raw Socket, and adds property-based tests (is_loopback_prop, check_user_loopback_prop) covering IPv4, IPv6, and IPv4-mapped-IPv6 loopback ranges. Affected product per CPE: cpe:2.3:a:rabbitmq:rabbitmq-server.

RemediationAI

Vendor-released patch: upgrade to RabbitMQ 3.13.15, 4.0.20, 4.1.11, or 4.2.6 (or later) as appropriate for your branch, per advisory GHSA-36m6-588r-vqcw and PRs #15936/#15940 (commits 7273c9e and 9f8c39f). If immediate patching is not possible, remove the enabling conditions: disable PROXY protocol on the affected listeners (set proxy_protocol = false) unless it is strictly required - note this loses real client IP visibility and breaks proxies that depend on it; alternatively bind listeners to a routable interface rather than loopback, or ensure the terminating proxy/load balancer is not reachable by untrusted networks. As a strong compensating control, remove guest from loopback_users and delete or disable the default guest account, or reset its well-known guest/guest password and scope its permissions - this closes the most impactful path since the flaw only matters for loopback-restricted users. Also restrict network access to the AMQP (5671/5672), AMQP 1.0, and Stream (5551/5552) ports to trusted sources. Verify PROXY protocol is only accepted from a trusted, authenticated proxy tier.

More in Rabbitmq Server

View all
CVE-2026-57219 HIGH POC
8.7 Jul 10

Sensitive credential disclosure in RabbitMQ affects installations running the management plugin with OAuth 2 configured

CVE-2019-11287 HIGH POC
7.5 Nov 23

Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x ver
CVE-2016-9877 CRITICAL
9.8 Dec 29

An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.
CVE-2025-50200 MEDIUM POC
5.5 Jun 19

RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in
CVE-2017-4966 HIGH
7.8 Jun 13

An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions p
CVE-2021-22117 HIGH
7.8 May 18

RabbitMQ installers on Windows prior to version 3.8.16 do not harden plugin directory permissions, potentially allowing

CVE-2026-57220 HIGH
7.5 Jul 10

Memory-exhaustion denial of service in RabbitMQ server prior to 4.2.6 allows an unauthenticated remote client to crash o
CVE-2026-57214 HIGH
7.1 Jul 10

Stored cross-site scripting in the RabbitMQ management UI (versions prior to 4.2.5) lets a user holding queue/exchange d
CVE-2026-57212 HIGH
7.1 Jul 10

Uncontrolled resource consumption in the RabbitMQ Management plugin's HTTP API lets an authenticated client crash or deg
CVE-2026-57217 HIGH
7.0 Jul 10

Authorization bypass in RabbitMQ topic permissions lets an authenticated user with restricted topic rights publish to or
CVE-2026-57215 HIGH
7.0 Jul 10

Improper authorization in RabbitMQ broker (versions prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6) allows an authenticated
CVE-2026-57211 CRITICAL
10.0 Jul 10

Server-side request forgery and NTLM credential exposure in the RabbitMQ management plugin (versions 4.1.0 to before 4.1

Same weakness CWE-287 – Improper Authentication

View all
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2020-0688 HIGH POC
8.8
CVE-2023-46805 HIGH POC
8.2
CVE-2023-35078 CRITICAL POC
9.8
CVE-2015-1187 CRITICAL POC
9.8
CVE-2024-7593 CRITICAL POC
9.8
CVE-2017-7921 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-57216 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy