Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.21, 4.1.11, and 4.2.6, RabbitMQ topic authorization can allow restricted topic writes and binds during metadata-store failures because topic-permission lookup errors from Khepri can collapse to undefined, which the internal backend treats as allow. This issue is fixed in versions 3.13.15, 4.0.21, 4.1.11, and 4.2.6.
CVE-2026-57217 is fixed upstream in RabbitMQ 4.2.6 (commit 94f1d33a70fcfa09006649599e79fc92786a2d36, "Khepri: distinguish missing keys from errors in one place"). Fedora status: - rawhide (4.3.3) and f44 (4.2.9) already ship >= 4.2.6 and therefore contain the fix. - f43 (4.0.9) is not affected in its default configuration. The flaw is in the Khepri-backed topic-permission lookup path (a Khepri lookup error collapsing to "undefined", which the internal backend treats as allow). In the 4.0.x series Khepri is opt-in and experimental, with Mnesia the default metadata store, so the vulnerable code path is not active by default. Closing as RAWHIDE: fixed in rawhide, f44 already carries the fix, and f43 is not affected in the default configuration.