CVE-2026-57215

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-57215", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-24T02:21:33.810Z", "datePublished": "2026-07-10T20:23:26.132Z", "dateUpdated": "2026-07-13T18:08:05.307Z"}, "containers": {"cna": {"title": "RabbitMQ: Direct-reply-to binding persistence can lead to unauthorized reply-channel injection and persistent phantom", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5cq3-v9jx-p3x3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5cq3-v9jx-p3x3"}, {"name": "https://github.com/rabbitmq/rabbitmq-server/pull/15935", "tags": ["x_refsource_MISC"], "url": "https://github.com/rabbitmq/rabbitmq-server/pull/15935"}, {"name": "https://github.com/rabbitmq/rabbitmq-server/pull/15938", "tags": ["x_refsource_MISC"], "url": "https://github.com/rabbitmq/rabbitmq-server/pull/15938"}, {"name": "https://github.com/rabbitmq/rabbitmq-server/commit/9055500d10ca7629dd2b051c6dc7a4b0bb8f6734", "tags": ["x_refsource_MISC"], "url": "https://github.com/rabbitmq/rabbitmq-server/commit/9055500d10ca7629dd2b051c6dc7a4b0bb8f6734"}, {"name": "https://github.com/rabbitmq/rabbitmq-server/commit/c84f3c880e0f22b49c01237cf8f86e176eeadc72", "tags": ["x_refsource_MISC"], "url": "https://github.com/rabbitmq/rabbitmq-server/commit/c84f3c880e0f22b49c01237cf8f86e176eeadc72"}, {"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"}], "affected": [{"vendor": "rabbitmq", "product": "rabbitmq-server", "versions": [{"version": ">= 4.2.0, < 4.2.6", "status": "affected"}, {"version": ">= 4.1.0, < 4.1.11", "status": "affected"}, {"version": ">= 4.0.0, < 4.0.21", "status": "affected"}, {"version": ">= 3.13.0, < 3.13.15", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-10T20:23:26.132Z"}, "descriptions": [{"lang": "en", "value": "RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ allows foreign bindings to amq.rabbitmq.reply-to destinations because volatile direct-reply-to queues can be accepted at bind and route time but are missing from Khepri-backed deletion checks, leaving persistent route entries after unbind. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6."}], "source": {"advisory": "GHSA-5cq3-v9jx-p3x3", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5cq3-v9jx-p3x3", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-13T18:07:36.918767Z", "id": "CVE-2026-57215", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-13T18:08:05.307Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-57215", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-13T18:07:36.918767Z"}}}], "references": [{"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5cq3-v9jx-p3x3", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-13T18:07:30.349Z"}}], "cna": {"title": "RabbitMQ: Direct-reply-to binding persistence can lead to unauthorized reply-channel injection and persistent phantom", "source": {"advisory": "GHSA-5cq3-v9jx-p3x3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "rabbitmq", "product": "rabbitmq-server", "versions": [{"status": "affected", "version": ">= 4.2.0, < 4.2.6"}, {"status": "affected", "version": ">= 4.1.0, < 4.1.11"}, {"status": "affected", "version": ">= 4.0.0, < 4.0.21"}, {"status": "affected", "version": ">= 3.13.0, < 3.13.15"}]}], "references": [{"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5cq3-v9jx-p3x3", "name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5cq3-v9jx-p3x3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/rabbitmq/rabbitmq-server/pull/15935", "name": "https://github.com/rabbitmq/rabbitmq-server/pull/15935", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rabbitmq/rabbitmq-server/pull/15938", "name": "https://github.com/rabbitmq/rabbitmq-server/pull/15938", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rabbitmq/rabbitmq-server/commit/9055500d10ca7629dd2b051c6dc7a4b0bb8f6734", "name": "https://github.com/rabbitmq/rabbitmq-server/commit/9055500d10ca7629dd2b051c6dc7a4b0bb8f6734", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rabbitmq/rabbitmq-server/commit/c84f3c880e0f22b49c01237cf8f86e176eeadc72", "name": "https://github.com/rabbitmq/rabbitmq-server/commit/c84f3c880e0f22b49c01237cf8f86e176eeadc72", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6", "name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ allows foreign bindings to amq.rabbitmq.reply-to destinations because volatile direct-reply-to queues can be accepted at bind and route time but are missing from Khepri-backed deletion checks, leaving persistent route entries after unbind. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-10T20:23:26.132Z"}}}, "cveMetadata": {"cveId": "CVE-2026-57215", "state": "PUBLISHED", "dateUpdated": "2026-07-13T18:08:05.307Z", "dateReserved": "2026-06-24T02:21:33.810Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-10T20:23:26.132Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "rabbitmq-server", "vendor": "rabbitmq", "versions": [{"status": "affected", "version": ">= 4.2.0, < 4.2.6"}, {"status": "affected", "version": ">= 4.1.0, < 4.1.11"}, {"status": "affected", "version": ">= 4.0.0, < 4.0.21"}, {"status": "affected", "version": ">= 3.13.0, < 3.13.15"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "6B5BD560-DF1B-43F3-BC3C-212B06A9BB64", "versionEndExcluding": "4.2.6", "versionStartIncluding": "3.13.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ allows foreign bindings to amq.rabbitmq.reply-to destinations because volatile direct-reply-to queues can be accepted at bind and route time but are missing from Khepri-backed deletion checks, leaving persistent route entries after unbind. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6."}, {"lang": "es", "value": "RabbitMQ es un broker de mensajer\u00eda y streaming. Antes de las versiones 3.13.15, 4.0.20, 4.1.11 y 4.2.6, RabbitMQ permite bindings externos a destinos amq.rabbitmq.reply-to porque las colas vol\u00e1tiles de respuesta directa (direct-reply-to) pueden ser aceptadas en el momento de la vinculaci\u00f3n (bind) y el enrutamiento (route) pero faltan en las comprobaciones de eliminaci\u00f3n respaldadas por Khepri, dejando entradas de ruta persistentes despu\u00e9s de la desvinculaci\u00f3n (unbind). Este problema est\u00e1 solucionado en las versiones 3.13.15, 4.0.20, 4.1.11 y 4.2.6."}], "id": "CVE-2026-57215", "lastModified": "2026-10-25T15:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57215", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-13T18:07:36.918767Z", "version": "2.0.3"}}]}, "published": "2026-07-10T21:16:58.550", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/rabbitmq/rabbitmq-server/commit/9055500d10ca7629dd2b051c6dc7a4b0bb8f6734"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/rabbitmq/rabbitmq-server/commit/c84f3c880e0f22b49c01237cf8f86e176eeadc72"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/rabbitmq/rabbitmq-server/pull/15935"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/rabbitmq/rabbitmq-server/pull/15938"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5cq3-v9jx-p3x3"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5cq3-v9jx-p3x3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "RabbitMQ: RabbitMQ: Persistent foreign bindings allow unauthorized message routing", "id": "2499204", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499204"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-459", "details": ["RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ allows foreign bindings to amq.rabbitmq.reply-to destinations because volatile direct-reply-to queues can be accepted at bind and route time but are missing from Khepri-backed deletion checks, leaving persistent route entries after unbind. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.", "A flaw was found in RabbitMQ, a messaging and streaming broker. This vulnerability allows an attacker to establish persistent foreign bindings to reply-to destinations. This occurs because temporary queues are not properly removed, leaving behind active routing entries. This can lead to unauthorized message routing and potential exposure of sensitive information."], "name": "CVE-2026-57215", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "impact": "moderate", "package_name": "rabbitmq-server4.2", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "impact": "moderate", "package_name": "rabbitmq-server4.3", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Not affected", "package_name": "rabbitmq-server", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Not affected", "package_name": "rabbitmq-server", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Not affected", "package_name": "rabbitmq-server", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-07-10T20:23:26Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-57215\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-57215\nhttps://github.com/rabbitmq/rabbitmq-server/commit/9055500d10ca7629dd2b051c6dc7a4b0bb8f6734\nhttps://github.com/rabbitmq/rabbitmq-server/commit/c84f3c880e0f22b49c01237cf8f86e176eeadc72\nhttps://github.com/rabbitmq/rabbitmq-server/pull/15935\nhttps://github.com/rabbitmq/rabbitmq-server/pull/15938\nhttps://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6\nhttps://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5cq3-v9jx-p3x3"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.2.0,4.2.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.1.0,4.1.11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.0.21)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.13.0,3.13.15)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "rabbitmq-server", "source": "cna", "vendor": "rabbitmq"}, "product": "rabbitmq-server", "vendor": "rabbitmq"}], "created": "2026-07-10T22:45:03.386940+00:00", "updated": "2026-08-05T02:45:17.250941+00:00", "vendors": ["rabbitmq", "rabbitmq$PRODUCT$rabbitmq-server"]}