PT-2026-57302 · Rabbitmq · Rabbitmq-Server

Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-57217

Mitre

CVSS v4.0

7.0

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.21, 4.1.11, and 4.2.6, RabbitMQ topic authorization can allow restricted topic writes and binds during metadata-store failures because topic-permission lookup errors from Khepri can collapse to undefined, which the internal backend treats as allow. This issue is fixed in versions 3.13.15, 4.0.21, 4.1.11, and 4.2.6.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-57217

Affected Products

Rabbitmq-Server

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-57217 · Security Note
• https://github.com/rabbitmq/rabbitmq-server/pull/15943 · Note
• https://github.com/rabbitmq/rabbitmq-server/pull/15941 · Note
• https://github.com/rabbitmq/rabbitmq-server/commit/94f1d33a70fcfa09006649599e79fc92786a2d36 · Note
• https://github.com/rabbitmq/rabbitmq-server/commit/ce1f682aa6b398820c5e3ce1ff7435184027c82c · Note
• https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-gpvw-75h5-3wvx · Note
• https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6 · Note