CVE-2026-57215 RabbitMQ: Direct-reply-to binding persistence can lead to unauthorized reply-channel injection and persistent phantom

High 7.0 Published 10 Jul 2026 Updated 13 Jul 2026

Attackers can inject unauthorized replies into direct-reply-to channels due to missing deletion checks, potentially intercepting sensitive data.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-57215?

CVE-2026-57215 is a high-severity missing authorization vulnerability in Broadcom Rabbitmq Server, published on 10 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ allows foreign bindings to amq.rabbitmq.reply-to destinations because volatile direct-reply-to queues can be accepted at bind and route time but are missing from Khepri-backed deletion checks, leaving persistent route entries after unbind. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

Weakness: CWE-863

Which versions are affected by CVE-2026-57215?

It affects 1 product.

Linux distribution packages (1)

rabbitmq-server openSUSE:Leap 16.0 All versions 4.1.5-160000.3.1

Products include Broadcom Rabbitmq Server.

How do I fix CVE-2026-57215?

Upgrade to a fixed version.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-57215 being exploited?

There is no known exploitation of CVE-2026-57215 in the wild and no public exploit code.

All Broadcom Rabbitmq Server vulnerabilities

Sources

Also known as AZL-92364, DEBIAN-CVE-2026-57215, GHSA-5cq3-v9jx-p3x3, UBUNTU-CVE-2026-57215, openSUSE-SU-2026:22163-1.