Bug 2499204 (CVE-2026-57215) - CVE-2026-57215 RabbitMQ: RabbitMQ: Persistent foreign bindings allow unauthorized message routing
Summary: CVE-2026-57215 RabbitMQ: RabbitMQ: Persistent foreign bindings allow unauthor...
Keywords:
Status: NEW
Alias: CVE-2026-57215
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2507937
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-10 21:01 UTC by OSIDB Bzimport
Modified: 2026-07-28 09:32 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-07-10 21:01:23 UTC 
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ allows foreign bindings to amq.rabbitmq.reply-to destinations because volatile direct-reply-to queues can be accepted at bind and route time but are missing from Khepri-backed deletion checks, leaving persistent route entries after unbind. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Note You need to log in before you can comment on or make changes to this bug.