CVE-2026-57217

Katalog CVE

CVSS 6.5 · Medium EPSS 0,35%

Kerentanan Incorrect Authorization pada broadcom rabbitmq server. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.21, 4.1.11, and 4.2.6, RabbitMQ topic authorization can allow restricted topic writes and binds during metadata-store failures because topic-permission lookup errors from Khepri can collapse to undefined, which the internal backend treats as allow. This issue is fixed in versions 3.13.15, 4.0.21, 4.1.11, and 4.2.6.

Rincian

Terbit di NVD

10 Juli 2026

Terakhir diubah

13 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-gpvw-75h5-3wvx exploit · advisory vendor
• https://github.com/rabbitmq/rabbitmq-server/commit/94f1d33a70fcfa09006649599e79fc92786a2d36 patch
• https://github.com/rabbitmq/rabbitmq-server/commit/ce1f682aa6b398820c5e3ce1ff7435184027c82c patch
• https://github.com/rabbitmq/rabbitmq-server/pull/15941 issue tracking · patch
• https://github.com/rabbitmq/rabbitmq-server/pull/15943 issue tracking · patch
• https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6 release notes