CVE-2026-57216
criticalRabbitMQ is a messaging and streaming broker.
Vendor / product: Broadcom — rabbitmq server
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication can allow a loopback-restricted user such as guest to connect remotely when traffic is accepted through a trusted PROXY-protocol path and the backend listener is loopback-bound because the loopback check uses the listener-side socket address instead of the real client source. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
CVSS
10.0
10.0 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-07-10 21:16
Modified: 2026-10-25 15:10
NVD status: Analyzed
Last synced 2 days ago
Verified against the source API 2026-10-27 07:07 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
broadcom / rabbitmq_server ≥3.13.0 <3.13.15, ≥4.0.0 <4.0.20, ≥4.1.0 <4.1.11, ≥4.2.0 <4.2.6
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-36m6-588r-vqcw
Vendor advisory: https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-36m6-588r-vqcw
Patch / mitigation: https://github.com/rabbitmq/rabbitmq-server/commit/7273c9eb6920abcde17b892dbe97ccaf906ead47
Patch / mitigation: https://github.com/rabbitmq/rabbitmq-server/commit/9f8c39fcf0acbc43080ee7017a62a02832114112
Patch / mitigation: https://github.com/rabbitmq/rabbitmq-server/pull/15936
Patch / mitigation: https://github.com/rabbitmq/rabbitmq-server/pull/15940
References
- https://github.com/rabbitmq/rabbitmq-server/commit/7273c9eb6920abcde17b892dbe97ccaf906ead4... security-advisories@github.com
- https://github.com/rabbitmq/rabbitmq-server/commit/9f8c39fcf0acbc43080ee7017a62a0283211411... security-advisories@github.com
- https://github.com/rabbitmq/rabbitmq-server/pull/15936 security-advisories@github.com
- https://github.com/rabbitmq/rabbitmq-server/pull/15940 security-advisories@github.com
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6 security-advisories@github.com
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-36m6-588r-vqcw security-advisories@github.com
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-36m6-588r-vqcw 134c704f-9b21-4f2e-91b3-4a467353bcc0
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:07 UTC · record ↗