CVE-2026-57221 - Vulnerability Details

- RabbitMQ: Passive queue/exchange declaration bypasses authorization checks, leaking queue metadata to unprivileged users

Description

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ does not perform authorization checks on passive queue.declare and exchange.declare AMQP 0-9-1 operations, allowing any authenticated user who can connect to a virtual host to enumerate queue and exchange names and read queue message and consumer counts. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

Published: 2026-07-10

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw allows any authenticated user who can connect to a virtual host in RabbitMQ Server to perform passive queue.declare and exchange.declare operations without the server verifying permissions. This bypass lets the user enumerate existing queue and exchange names and read message and consumer counts, thereby leaking metadata about the messaging environment. This users to gain data they are not permitted to access.

Affected Systems

RabbitMQ Server is affected. Any installation running a version prior to 3.13.15, 4.0.20, 4.1.11, or 4.2.6 is vulnerable. The issue is announced for rabbitmq:rabbitmq-server.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score is below 1%, showing a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. An attacker needs to be authenticated to a virtual host; once authenticated, they can enumerate queue and exchange names and read message and consumer counts via passive declare operations, without requiring privilege escalation or code execution.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

rabbitmq

rabbitmq-server

affected

Version	Status	Constraints
`>= 4.2.0, < 4.2.6`	affected	—
`>= 4.1.0, < 4.1.11`	affected	—
`>= 4.0.0, < 4.0.21`	affected	—
`>= 3.13.0, < 3.13.15`	affected	—

No data.

Vendor Product Confidence Versions

Rabbitmq

Rabbitmq-server

100%

Version	Status	Scheme	Platform
`[4.2.0,4.2.6)`	affected	semver	—
`[4.1.0,4.1.11)`	affected	semver	—
`[4.0.0,4.0.21)`	affected	semver	—
`[3.13.0,3.13.15)`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade RabbitMQ Server to version 3.13.15, 4.0.20, 4.1.11, 4.2.6, or later.
Restrict virtual host access by configuring permissions to limit which authenticated users can perform declare operations and removing unnecessary user accounts.
Apply network segmentation or firewall rules to restrict external access to the RabbitMQ broker port, ensuring only trusted hosts can connect.

Generated by OpenCVE AI on July 28, 2026 at 08:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0041.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/rabbitmq/rabbitmq-server/commit/709a14e49e06c138a8cd672c9809ca34a2767962
https://github.com/rabbitmq/rabbitmq-server/commit/dc3d1aa4f5c3331a425ee599b45be9423a2e83fc
https://github.com/rabbitmq/rabbitmq-server/pull/16085
https://github.com/rabbitmq/rabbitmq-server/pull/16090
https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6
https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-9q2j-2hq8-22r2
https://nvd.nist.gov/vuln/detail/CVE-2026-57221
https://www.cve.org/CVERecord?id=CVE-2026-57221

History

Tue, 28 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-425
References		https://nvd.nist.gov/vuln/detail/CVE-2026-57221 https://www.cve.org/CVERecord?id=CVE-2026-57221
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.0, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N'}` threat_severity `Moderate`

Mon, 13 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 10 Jul 2026 22:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Rabbitmq Rabbitmq rabbitmq-server
Vendors & Products		Rabbitmq Rabbitmq rabbitmq-server

Fri, 10 Jul 2026 20:45:00 +0000

Type	Values Removed	Values Added
Description		RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ does not perform authorization checks on passive queue.declare and exchange.declare AMQP 0-9-1 operations, allowing any authenticated user who can connect to a virtual host to enumerate queue and exchange names and read queue message and consumer counts. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Title		RabbitMQ: Passive queue/exchange declaration bypasses authorization checks, leaking queue metadata to unprivileged users
Weaknesses		CWE-862
References		https://github.com/rabbitmq/rabbitmq-server/commit/709a14e49e06c138a8cd672c9809ca34a2767962 https://github.com/rabbitmq/rabbitmq-server/commit/dc3d1aa4f5c3331a425ee599b45be9423a2e83fc https://github.com/rabbitmq/rabbitmq-server/pull/16085 https://github.com/rabbitmq/rabbitmq-server/pull/16090 https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6 https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-9q2j-2hq8-22r2
Metrics		cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N'}`

Subscriptions

Rabbitmq Rabbitmq-server

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2026-07-10T20:24:27.921Z

Updated: 2026-07-13T18:05:48.847Z

Reserved: 2026-06-24T02:21:33.810Z

Link: CVE-2026-57221

Vulnrichment

Updated: 2026-07-13T18:05:00.820Z

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-10T20:24:27Z

Links: CVE-2026-57221 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-28T08:15:06Z

Weaknesses

CWE-425
Direct Request ('Forced Browsing')
CWE-862
Missing Authorization

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object