CyberRota Analysis
AI-GeneratedRabbitMQ versions prior to 3.13.15, 4.0.21, 4.1.11, and 4.2.6 are vulnerable to a topic authorization flaw that may permit unauthorized writes and binds during metadata-store failures. This vulnerability arises from topic-permission lookup errors being misinterpreted as allowed actions, potentially leading to unauthorized access to sensitive messaging data. Organizations using affected RabbitMQ versions should prioritize upgrading to the patched releases to mitigate the risk of unauthorized data manipulation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.21, 4.1.11, and 4.2.6, RabbitMQ topic authorization can allow restricted topic writes and binds during metadata-store failures because topic-permission lookup errors from Khepri can collapse to undefined, which the internal backend treats as allow. This issue is fixed in versions 3.13.15, 4.0.21, 4.1.11, and 4.2.6.
Related CVEs
Other vulnerabilities affecting the same vendor(s)