AMQP 1.0 Management Endpoint Exposes Binding Topology in RabbitMQ
CVE-2026-61837
What is CVE-2026-61837?
The RabbitMQ messaging broker's AMQP 1.0 management interface has a significant flaw that allows any authenticated user to access the full binding topology within their virtual host. This includes critical information such as source exchanges, destination queues/exchanges, routing keys, and binding arguments. The vulnerability arises from the GET /bindings endpoint failing to perform required permission checks, enabling authenticated AMQP users—regardless of their management permissions—to enumerate complete binding configurations. To mitigate this issue, users are advised to upgrade to versions 4.3.3, 4.2.9, 4.1.14, or 4.0.23.
Affected Version(s)
rabbitmq-server >= 4.3.0, < 4.3.3 < 4.3.0, 4.3.3
rabbitmq-server >= 4.2.0, < 4.2.9 < 4.2.0, 4.2.9
rabbitmq-server >= 4.1.0, < 4.1.14 < 4.1.0, 4.1.14