Junglewise Threat Intelligence

CVE-2026-57221: RabbitMQ missing authorization in passive queue and exchange declarations

CVE-2026-57221 · Severity: info · CVSS 5.3 · Published 2026-07-10

Technologies: RabbitMQ. Vendors: RabbitMQ.

Executive brief

RabbitMQ is a widely used message broker that facilitates communication between different software applications. A security flaw allowed any user with basic access to a virtual host to view the names of all message queues and exchanges, as well as see how many messages and consumers were active on them. While this does not allow users to read the actual content of the messages, it could expose sensitive information about system architecture and operational volume to unauthorized parties.

Technical details

RabbitMQ is vulnerable to missing authorization checks (CWE-862) within its AMQP 0-9-1 implementation. Specifically, the 'passive' flag in queue.declare and exchange.declare operations bypassed the standard 'configure' permission checks. An authenticated attacker with access to a virtual host could use these passive declarations to verify the existence of specific queues and exchanges, as well as retrieve metadata including message counts and consumer counts. This information disclosure occurs because the broker failed to apply the same authorization logic to passive declarations as it does to regular declarations. The issue is resolved in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6 by enforcing 'configure' permission checks on these operations.

Affected products

  • RabbitMQ RabbitMQ >= 3.13.0, < 3.13.15; >= 4.0.0, < 4.0.20; >= 4.1.0, < 4.1.11; >= 4.2.0, < 4.2.6

Timeline

  • 2026-04-14: patched: Fixes merged into main and backport branches.
  • 2026-04-23: advisory: Release of version 4.2.6 containing the fix.
  • 2026-07-10: disclosed: CVE-2026-57221 published.

References