CVE-2026-57221

Received Received - Intake

Information Disclosure in RabbitMQ

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ does not perform authorization checks on passive queue.declare and exchange.declare AMQP 0-9-1 operations, allowing any authenticated user who can connect to a virtual host to enumerate queue and exchange names and read queue message and consumer counts. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-10

Last Modified

2026-07-10

Generated

2026-07-11

AI Q&A

2026-07-11

EPSS Evaluated

N/A

NVD

CVE-2026-57221

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq	to 3.13.15 (exc)
rabbitmq	rabbitmq	to 4.0.20 (exc)
rabbitmq	rabbitmq	to 4.1.11 (exc)
rabbitmq	rabbitmq	to 4.2.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Mitigation Strategies

To mitigate this vulnerability, upgrade RabbitMQ to one of the fixed versions: 3.13.15, 4.0.20, 4.1.11, or 4.2.6.

Executive Summary

This vulnerability affects RabbitMQ versions prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6. It occurs because RabbitMQ does not perform authorization checks on passive queue.declare and exchange.declare AMQP 0-9-1 operations.

As a result, any authenticated user who can connect to a virtual host can enumerate the names of queues and exchanges, and also read the counts of messages and consumers on those queues.

Impact Analysis

The vulnerability allows an authenticated user to gather information about the messaging infrastructure by enumerating queue and exchange names and reading message and consumer counts.

This information disclosure could aid an attacker in understanding the system's messaging topology and potentially planning further attacks or exploiting other weaknesses.

Hi! I’m here to help you understand CVE-2026-57221. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70