Skip to main content

RabbitMQ EUVDEUVD-2026-43022

| CVE-2026-57215 HIGH
Incorrect Authorization (CWE-863)
2026-07-10 GitHub_M
Authentication Bypass Rabbitmq Server Suse Red Hat
7.0
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
7.0 HIGH
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.3 MEDIUM

Authenticated client (PR:L) over the network (AV:N) exploiting a timing/route-persistence race (AC:H) to read another client's replies, crossing a trust boundary (S:C) with confidentiality-only impact (C:H, I:N, A:N).

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Red Hat
8.1 HIGH
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Patch available
Jul 10, 2026 - 22:02 EUVD
Analysis Generated
Jul 10, 2026 - 21:25 vuln.today

DescriptionCVE.org

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ allows foreign bindings to amq.rabbitmq.reply-to destinations because volatile direct-reply-to queues can be accepted at bind and route time but are missing from Khepri-backed deletion checks, leaving persistent route entries after unbind. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

AnalysisAI

Improper authorization in RabbitMQ broker (versions prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6) allows an authenticated client to create foreign bindings against another connection's volatile amq.rabbitmq.reply-to (direct reply-to) destination, so persistent route entries survive after unbind and can leak RPC reply traffic intended for other clients. The flaw stems from Khepri-backed deletion checks that omit these volatile pseudo-queues, letting stale routes persist. No public exploit identified at time of analysis; exploitation requires valid credentials and has high attack complexity per the vendor CVSS 4.0 vector.

Technical ContextAI

RabbitMQ's amq.rabbitmq.reply-to is a pseudo-destination used for the direct reply-to RPC pattern: it creates ephemeral, volatile queues that live only for the duration of a request/response exchange rather than being declared as durable objects. Khepri is RabbitMQ's Raft-based metadata store (the successor to the Mnesia-based schema database) that tracks queues, exchanges, and bindings. Per CWE-863 (Incorrect Authorization), the root cause is that these volatile direct-reply-to queues are validated and accepted at bind and route time but are absent from Khepri's deletion/unbind checks, so route entries are not properly torn down and no authorization boundary prevents a foreign connection from binding to another client's reply-to destination. The affected component is the rabbitmq-server messaging broker (cpe:2.3:a:rabbitmq:rabbitmq-server), specifically its binding and routing subsystem when backed by the Khepri metadata store.

RemediationAI

Vendor-released patch: upgrade to RabbitMQ 3.13.15, 4.0.20, 4.1.11, or 4.2.6 (or later) depending on your branch - these are the exact fixed versions named by the vendor. Follow the advisory GHSA-5cq3-v9jx-p3x3 (https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5cq3-v9jx-p3x3); the fix is delivered via pull requests https://github.com/rabbitmq/rabbitmq-server/pull/15935 and https://github.com/rabbitmq/rabbitmq-server/pull/15938 and commits 9055500d10ca7629dd2b051c6dc7a4b0bb8f6734 and c84f3c880e0f22b49c01237cf8f86e176eeadc72, with the 4.2.6 release at https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6. If immediate patching is not possible, compensating controls include tightening per-vhost and per-user permissions so untrusted clients cannot share a virtual host with sensitive RPC workloads (isolate tenants into separate vhosts), and restricting broker access to trusted application accounts only - the trade-off is operational overhead and potential disruption to clients that legitimately rely on shared vhosts. Avoiding or restricting the direct reply-to (amq.rabbitmq.reply-to) RPC pattern for sensitive traffic reduces exposure but requires application-level changes to the RPC design.

More in Rabbitmq Server

View all
CVE-2026-57219 HIGH POC
8.7 Jul 10

Sensitive credential disclosure in RabbitMQ affects installations running the management plugin with OAuth 2 configured

CVE-2019-11287 HIGH POC
7.5 Nov 23

Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x ver
CVE-2016-9877 CRITICAL
9.8 Dec 29

An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.
CVE-2025-50200 MEDIUM POC
5.5 Jun 19

RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in
CVE-2017-4966 HIGH
7.8 Jun 13

An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions p
CVE-2021-22117 HIGH
7.8 May 18

RabbitMQ installers on Windows prior to version 3.8.16 do not harden plugin directory permissions, potentially allowing

CVE-2026-57220 HIGH
7.5 Jul 10

Memory-exhaustion denial of service in RabbitMQ server prior to 4.2.6 allows an unauthenticated remote client to crash o
CVE-2026-57214 HIGH
7.1 Jul 10

Stored cross-site scripting in the RabbitMQ management UI (versions prior to 4.2.5) lets a user holding queue/exchange d
CVE-2026-57212 HIGH
7.1 Jul 10

Uncontrolled resource consumption in the RabbitMQ Management plugin's HTTP API lets an authenticated client crash or deg
CVE-2026-57217 HIGH
7.0 Jul 10

Authorization bypass in RabbitMQ topic permissions lets an authenticated user with restricted topic rights publish to or
CVE-2026-57216 CRITICAL
10.0 Jul 10

Authentication bypass in RabbitMQ (broker versions prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6) lets a loopback-restrict
CVE-2026-57211 CRITICAL
10.0 Jul 10

Server-side request forgery and NTLM credential exposure in the RabbitMQ management plugin (versions 4.1.0 to before 4.1

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8
CVE-2017-4915 HIGH POC
7.8
CVE-2024-6782 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Not-Affected

Share

EUVD-2026-43022 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy