CVE-2026-61837

Undergoing Analysis Undergoing Analysis - In Progress

Information Disclosure in RabbitMQ AMQP 1.0 Management

Publication date: 2026-09-25

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, AMQP 1.0 management GET /bindings exposes full binding topology to any authenticated AMQP user without resource/management permission checks. the AMQP 1.0 HTTP-over-AMQP management endpoint GET /bindings (the rabbitamqpmanagement handler) enumerates bindings between an arbitrary source exchange and destination queue/exchange in the caller's virtual host without performing any resource-level permission check. Unlike every sibling operation in the same module (which call checkresourceaccess / bindingchecks), the GET handler ignores the authenticated User and returns the binding list unchanged. As a result, any authenticated AMQP 1.0 client that can open a management link pair , including users with no management/monitoring/policymaker/administrator tag , can enumerate the complete binding topology (source exchanges, destination queues/exchanges, routing keys, and binding arguments) of the virtual host they can access. The equivalent HTTP management API (GET /api/bindings) Confidentiality impact: a non-management AMQP 1.0 user can enumerate the complete routing topology of any virtual host it can connect to , every (source exchange, destination queue/exchange, routing key, binding arguments) This issue is fixed in versions 4.3.3, 4.2.9, 4.1.14, and 4.0.23.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-61837

EUVD

EUVD-2026-87227

Affected Vendors & Products

Vendor	Product	Version / Range
broadcom	rabbitmq_server	From 4.1.0 (inc) to 4.1.14 (exc)
broadcom	rabbitmq_server	From 4.2.0 (inc) to 4.2.9 (exc)
broadcom	rabbitmq_server	From 4.3.0 (inc) to 4.3.3 (exc)
broadcom	rabbitmq_server	From 4.0.0 (inc) to 4.0.23 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

RabbitMQ versions 4.0.0 to 4.3.3, 4.2.9, 4.1.14, and 4.0.23 have a flaw in the AMQP 1.0 management endpoint. The GET /bindings endpoint exposes the full binding topology of a virtual host to any authenticated AMQP user, even without proper permissions. This allows unauthorized users to see all exchanges, queues, routing keys, and binding arguments within their accessible virtual host.

Detection Guidance

To detect this vulnerability, check if your RabbitMQ version is between 4.0.0 and 4.3.3, 4.2.9, 4.1.14, or 4.0.23. Use the command: rabbitmqctl status to check the version. If vulnerable, any authenticated AMQP 1.0 client can enumerate binding topology via GET /bindings.

Impact Analysis

This vulnerability allows any authenticated AMQP 1.0 user to gather sensitive routing information about your RabbitMQ setup. Attackers could map your messaging infrastructure, identify critical queues or exchanges, and potentially exploit this data for further attacks like message interception or denial of service.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive data flows. GDPR requires protecting personal data, and HIPAA mandates securing health information. Exposure of routing topology may reveal data processing paths, violating confidentiality requirements.

Mitigation Strategies

Upgrade RabbitMQ to a patched version: 4.3.3, 4.2.9, 4.1.14, or 4.0.23. If upgrading is not immediately possible, restrict AMQP 1.0 access to trusted users or disable the AMQP 1.0 management endpoint.

Hi! I’m here to help you understand CVE-2026-61837. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70