Topic Authorization Bypass in RabbitMQ

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.21, 4.1.11, and 4.2.6, RabbitMQ topic authorization can allow restricted topic writes and binds during metadata-store failures because topic-permission lookup errors from Khepri can collapse to undefined, which the internal backend treats as allow. This issue is fixed in versions 3.13.15, 4.0.21, 4.1.11, and 4.2.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-10

Last Modified

2026-07-10

Generated

2026-07-11

AI Q&A

2026-07-11

EPSS Evaluated

N/A

NVD

CVE-2026-57217

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq	to 3.13.15 (exc)
rabbitmq	rabbitmq	to 4.0.21 (exc)
rabbitmq	rabbitmq	to 4.1.11 (exc)
rabbitmq	rabbitmq	to 4.2.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability affects RabbitMQ, a messaging and streaming broker. Before certain fixed versions (3.13.15, 4.0.21, 4.1.11, and 4.2.6), there was an issue where topic authorization could incorrectly allow restricted topic writes and binds during metadata-store failures. This happens because errors in topic-permission lookups from the Khepri component could collapse to an undefined state, which the internal backend then treats as allowed, effectively bypassing intended restrictions.

Impact Analysis

The vulnerability can lead to unauthorized writes and binds to restricted topics in RabbitMQ during certain failure conditions. This means that an attacker or unauthorized user might be able to send or bind messages to topics they should not have access to, potentially leading to data leakage, message tampering, or disruption of messaging workflows.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade RabbitMQ to one of the fixed versions: 3.13.15, 4.0.21, 4.1.11, or 4.2.6.

Hi! I’m here to help you understand CVE-2026-57217. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70