CVE-2026-57218: broadcom rabbitmq_server Incorrect Authorization
Vulnerability summary
CVE-2026-57218 is a medium (CVSS 6.5) Incorrect Authorization vulnerability in broadcom rabbitmq_server. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.2% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 5 · Related 3Timeline
- 10-07-2026PublishedVulnerability first disclosed.
- 13-07-2026Last modifiedVulnerability information updated.
Description
RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expiry or connection.update_secret refresh to reduced scopes because existing consumers are not canceled or reauthorized at delivery time after the channel user state changes. This issue is fixed in version 4.2.6.
CVSS metrics
6 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated4.9MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
- NVDNIST4.9MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.35%
Chance of exploitation in the next 30 days
Percentile
27%
Versus all other CVEs
30-day change
-0.21 pp
From 0.56% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundRabbitmq Server
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Broadcom1 product
- rabbitmq_server≥ 4.2.0, < 4.2.6
Debian1 product
- rabbitmq-server< 4.3.0-2
Rabbitmq1 product
- rabbitmq-server≥ 4.2.0, < 4.2.6
Ubuntu1 product
- rabbitmq-serverAll versions (No fix recorded)
4 vendors · 4 products
References
10 links- github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-wmrr-4h5v-5ch7X Refsource CONFIRMREPORTExploitVendor Advisory
- github.com/rabbitmq/rabbitmq-server/commit/501ad947cd6bbcc9486fe96e0d073992bfe52cc4X Refsource MISCREPORTPatch
- github.com/rabbitmq/rabbitmq-server/commit/db20d6c0fcf3056030f244b5adab0d45c0db0c9eX Refsource MISCREPORTPatch
