RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.21, 4.1.11, and 4.2.6, RabbitMQ topic authorization can allow restricted topic writes and binds during metadata-store failures because topic-permission lookup errors from Khepri can collapse to undefined, which the internal backend treats as allow. This issue is fixed in versions 3.13.15, 4.0.21, 4.1.11, and 4.2.6.
Fix
Patch, vendor advisory and mitigation references on NVD 6
- https://github.com/rabbitmq/rabbitmq-server/commit/94f1d33a70fcfa09006649599e79fc92786a2d36 Patch
- https://github.com/rabbitmq/rabbitmq-server/commit/ce1f682aa6b398820c5e3ce1ff7435184027c82c Patch
- https://github.com/rabbitmq/rabbitmq-server/pull/15941 Issue Tracking, Patch
- https://github.com/rabbitmq/rabbitmq-server/pull/15943 Issue Tracking, Patch
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-gpvw-75h5-3wvx Exploit, Vendor Advisory
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-gpvw-75h5-3wvx Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.0 · broadcomNVD modified 2026-10-25 15:10
Affected (CPE criteria) 1
cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*
References 7
- https://github.com/rabbitmq/rabbitmq-server/commit/94f1d33a70fcfa09006649599e79fc92786a2d36 Patch
- https://github.com/rabbitmq/rabbitmq-server/commit/ce1f682aa6b398820c5e3ce1ff7435184027c82c Patch
- https://github.com/rabbitmq/rabbitmq-server/pull/15941 Issue Tracking, Patch
- https://github.com/rabbitmq/rabbitmq-server/pull/15943 Issue Tracking, Patch
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6 Release Notes
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-gpvw-75h5-3wvx Exploit, Vendor Advisory
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-gpvw-75h5-3wvx Exploit, Vendor Advisory