RabbitMQ CVE-2026-61837

Requires a valid AMQP 1.0 credential on the RabbitMQ broker (any user that can connect to a virtual host), but NO management, monitoring, policymaker, or administrator tag and no resource-level read/write permission on the target exchanges/queues. The specific trigger is the AMQP 1.0 HTTP-over-AMQP management endpoint GET /bindings (the rabbit_amqp_management GET handler) - the sibling equivalent HTTP API GET /api/bindings performs proper checks and is not the vulnerable path. Affected only in versions 4.0.0 through 4.0.22 / 4.1.x <4.1.14 / 4.2.x <4.2.9 / 4.3.x <4.3.3; the AMQP 1.0 protocol/management link support must be in use. Limiting factors: an attacker must already possess valid broker credentials, disclosure is confined to the virtual host(s) that account can access, and only routing topology metadata (not message payloads) is exposed.

The CVSS 4.0 base score of 6.3 (AV:N/AC:L/AT:N/PR:L/UI:N with SC:H) reflects a network-reachable, low-complexity flaw requiring only a low-privileged authenticated AMQP 1.0 account, with impact limited to disclosure of binding topology. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so this is not confirmed to be under active exploitation and no weaponized exploit is known. The realistic severity is lower than the headline number implies: the leaked data is routing metadata (exchanges, queues, routing keys, binding arguments) rather than message contents or credentials - a confidentiality-only issue with no integrity or availability impact. Note a modeling nuance: NVD placed the confidentiality impact in the subsequent-system metric (SC:H) with VC:N, which inflates the score versus treating it as a bounded metadata leak of the vulnerable system (VC:L); this is worth verifying against the vendor advisory. Overall this is a moderate, defense-in-depth authorization hardening fix rather than an urgent priority, though its ease of triggering against any authenticated tenant makes patching worthwhile in multi-tenant brokers.

A tenant or application holding an ordinary AMQP 1.0 account with no management/monitoring/policymaker/administrator tag opens a management link pair and issues GET /bindings for arbitrary source/destination pairs. Because the handler skips the resource permission check that every sibling operation performs, the client receives the complete binding topology of its virtual host - mapping every exchange-to-queue route, routing key, and binding argument. No public exploit code is identified at time of analysis, but exploitation is trivial using the standard rabbitmq_amqp_client.