RabbitMQ Server’s management user interface on Windows is vulnerable to a Server Side Request Forgery that allows an attacker to supply URL‑encoded to a file‑information routine before normal path validation. As a result, the broker resolves the supplied UNC path and initiates outbound DNS and SMB queries to an attacker‑controlled server. This behavior provides the attacker with the ability to discover internal hostnames or shared resources and potentially pivot to other systems, but it does not enable remote code execution or privilege escalation on the broker itself.

The flaw is present only in Windows deployments of RabbitMQ Server and affects versions earlier than 4.1.11 in the 4.1.x series and earlier than 4.2.6 in the 4.2.x series. It requires that more than one management extension plugin be enabled; the vulnerability manifests when the static file handler processes a URL containing UNC syntax.

A CVSS base score of 6.5 indicates moderate severity, while an EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation. The described behavior infers that an attacker needs network access to the management UI to trigger the SSRF; if the UI is exposed to untrusted networks, a crafted request can cause the broker to reach internal resources and potentially aid lateral movement.