Vulnerability Details CVE-2026-57215
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ allows foreign bindings to amq.rabbitmq.reply-to destinations because volatile direct-reply-to queues can be accepted at bind and route time but are missing from Khepri-backed deletion checks, leaving persistent route entries after unbind. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 15.6%
CVSS Severity
References
- https://github.com/rabbitmq/rabbitmq-server/commit/9055500d10ca7629dd2b051c6dc7a4b0bb8f6734
- https://github.com/rabbitmq/rabbitmq-server/commit/c84f3c880e0f22b49c01237cf8f86e176eeadc72
- https://github.com/rabbitmq/rabbitmq-server/pull/15935
- https://github.com/rabbitmq/rabbitmq-server/pull/15938
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5cq3-v9jx-p3x3