CVE-2026-57221

Katalog CVE

CVSS 5.0 · Medium EPSS 0,41%

Kerentanan Missing Authorization pada broadcom rabbitmq server. Skor CVSS 3.1 5.0 (Medium) menurut NVD.

Deskripsi (NVD)

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ does not perform authorization checks on passive queue.declare and exchange.declare AMQP 0-9-1 operations, allowing any authenticated user who can connect to a virtual host to enumerate queue and exchange names and read queue message and consumer counts. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

Rincian

Terbit di NVD

10 Juli 2026

Terakhir diubah

13 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.0 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-9q2j-2hq8-22r2 exploit · advisory vendor
• https://github.com/rabbitmq/rabbitmq-server/commit/709a14e49e06c138a8cd672c9809ca34a2767962 patch
• https://github.com/rabbitmq/rabbitmq-server/commit/dc3d1aa4f5c3331a425ee599b45be9423a2e83fc patch
• https://github.com/rabbitmq/rabbitmq-server/pull/16085 issue tracking · patch
• https://github.com/rabbitmq/rabbitmq-server/pull/16090 issue tracking · patch
• https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6 release notes