Bug 2507985 - CVE-2026-57217 rabbitmq-server: RabbitMQ: Authorization bypass allows unauthorized topic writes and binds during metadata-store failures [fedora-all]
Summary: CVE-2026-57217 rabbitmq-server: RabbitMQ: Authorization bypass allows unautho...
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: rabbitmq-server
Version: rawhide
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
Assignee: Peter Lemenkov
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: {"flaws": ["3a099faa-684d-4b78-a9f5-d...
Depends On:
Blocks: CVE-2026-57217
TreeView+ depends on / blocked
 
Reported: 2026-07-28 12:37 UTC by Marian Rehak
Modified: 2026-07-30 13:20 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2026-07-30 13:20:27 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Marian Rehak 2026-07-28 12:37:49 UTC
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.21, 4.1.11, and 4.2.6, RabbitMQ topic authorization can allow restricted topic writes and binds during metadata-store failures because topic-permission lookup errors from Khepri can collapse to undefined, which the internal backend treats as allow. This issue is fixed in versions 3.13.15, 4.0.21, 4.1.11, and 4.2.6.

Comment 1 Peter Lemenkov 2026-07-30 13:20:27 UTC
CVE-2026-57217 is fixed upstream in RabbitMQ 4.2.6 (commit 94f1d33a70fcfa09006649599e79fc92786a2d36, "Khepri: distinguish missing keys from errors in one place").

Fedora status:
- rawhide (4.3.3) and f44 (4.2.9) already ship >= 4.2.6 and therefore contain the fix.
- f43 (4.0.9) is not affected in its default configuration. The flaw is in the Khepri-backed topic-permission lookup path (a Khepri lookup error collapsing to "undefined", which the internal backend treats as allow). In the 4.0.x series Khepri is opt-in and experimental, with Mnesia the default metadata store, so the vulnerable code path is not active by default.

Closing as RAWHIDE: fixed in rawhide, f44 already carries the fix, and f43 is not affected in the default configuration.


Note You need to log in before you can comment on or make changes to this bug.