CVE-2026-57217CWE-863

RabbitMQ: Topic authorization can lead to cross-tenant routing-key bypass

High · published July 10, 2026

CVSS v4.0
7.0
EPSS
0%
Percentile
27.6
In the wild
Unconfirmed
What it is

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.21, 4.1.11, and 4.2.6, RabbitMQ topic authorization can allow restricted topic writes and binds during metadata-store failures because topic-permission lookup errors from Khepri can collapse to undefined, which the internal backend treats as allow. This issue is fixed in versions 3.13.15, 4.0.21, 4.1.11, and 4.2.6.

The record
Technical detail
CVSS v4.0
7.0 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00352 · 27.6th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-07-10T20:25Z
EPSS history
Timeline
  • 10 JUL 20:25Z
    RabbitMQ: Topic authorization can lead to cross-tenant routing-key bypass
    cvelistv5