CVE-2026-57215

Received Received - Intake

RabbitMQ Foreign Bindings to amq.rabbitmq.reply-to Allowed

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ allows foreign bindings to amq.rabbitmq.reply-to destinations because volatile direct-reply-to queues can be accepted at bind and route time but are missing from Khepri-backed deletion checks, leaving persistent route entries after unbind. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-10

Last Modified

2026-07-10

Generated

2026-07-11

AI Q&A

2026-07-11

EPSS Evaluated

N/A

NVD

CVE-2026-57215

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq	to 3.13.15 (exc)
rabbitmq	rabbitmq	to 4.0.20 (exc)
rabbitmq	rabbitmq	to 4.1.11 (exc)
rabbitmq	rabbitmq	to 4.2.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in RabbitMQ occurs because the system allows foreign bindings to amq.rabbitmq.reply-to destinations. Specifically, volatile direct-reply-to queues can be accepted during bind and route operations but are not properly checked during deletion by the Khepri-backed mechanism. As a result, persistent route entries remain after unbinding, which should not happen.

This issue affects RabbitMQ versions prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, and has been fixed in these versions.

Impact Analysis

The vulnerability can lead to persistent route entries remaining in RabbitMQ after unbinding, which may cause unexpected message routing behavior or resource leakage.

Because the CVSS base score is 7.0 with network attack vector and requires low privileges, it indicates a high severity issue that could be exploited remotely to affect the availability or integrity of the messaging system.

Mitigation Strategies

To mitigate this vulnerability, upgrade RabbitMQ to one of the fixed versions: 3.13.15, 4.0.20, 4.1.11, or 4.2.6.

Hi! I’m here to help you understand CVE-2026-57215. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70