CVE-2026-57221: RabbitMQ: Passive queue/exchange declaration bypasses authorization checks, leaking queue metadata to unprivileged users
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ does not perform authorization checks on passive queue.declare and exchange.declare AMQP 0-9-1 operations, allowing any authenticated user who can connect to a virtual host to enumerate queue and exchange names and read queue message and consumer counts. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 3.13.15 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.0.20 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.1.11 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.2.6
Event History
Frequently Asked Questions
What is the risk level of CVE-2026-57221?
CVE-2026-57221 is rated with a medium severity level of 5.3.
How does CVE-2026-57221 affect RabbitMQ users?
CVE-2026-57221 allows unprivileged users to bypass authorization checks, leading to the leak of queue metadata.
What versions of RabbitMQ are affected by CVE-2026-57221?
CVE-2026-57221 affects RabbitMQ versions prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
How can I mitigate the vulnerability identified as CVE-2026-57221?
To mitigate CVE-2026-57221, upgrade your RabbitMQ server to a version that is not affected, such as 3.13.15 or later.
Is authentication sufficient to protect against CVE-2026-57221?
No, merely authenticating users is not sufficient; the vulnerability allows authenticated users to bypass authorization checks.