RabbitMQ Topic Authorization Bypass Vulnerability (CVE-2026-57217) with PoC

Vulnerability Overview Vulnerability Name: Topic authorization can lead to cross-tenant routing-key bypass CVE ID: CVE-2026-57217 Severity: High (7.0 / 10) CVSS v4 base metrics: Attack Vector: Network Attack Complexity: Low Attack Requirements: Present Privileges Required: Low User Interaction: None Confidentiality: High Integrity: None Availability: None Description: RabbitMQ topic authorization allows restricted operations to be executed during metadata store failures due to faulty error folding causing topic permission lookup failures. The internal backend treats undefined results as allowed, and this behavior occurs when the database returns undefined; any Khepri response that is not , including timeout/error paths, leads to this outcome. This results in authorization succeeding after transient Khepri lookup failures, allowing publishes/bindings to routing keys that should have been denied. Deterministic reproduction via verification showed this: denied before the failure, allowed during the Khepri timeout, and denied again after recovery. Investigation of expected behavior also indicates this is not intended, as missing authorization would shrink the transaction (error, error)—i.e., the error path—rather than implicitly allowing it. Impact Scope Affected Versions: - - - - Fixed Versions: Impact: Low-privilege tenants can publish to or bind to routing keys outside their configured topic regular expressions in shared topic exchanges, enabling unauthorized message routing when Khepri lookups fail. Remediation Upgrade to fixed versions: - - - - POC Code PoC Steps 1. Ensure the running RabbitMQ broker has the management API accessible at and access. 2. Create the directory . 3. Create the file and paste the code above. 4. Run . 5. Run . 6. Observe that the baseline publish is denied, the publish succeeds during the Khepri timeout, and is denied again after recovery. PoC Results The results show that the policy-controlled topic publish becomes routable during the Khepri lookup error window and is denied again after the metadata store recovers.

Goal Reached Thanks to every supporter — we hit 100%!

RabbitMQ Topic Authorization Bypass Vulnerability (CVE-2026-57217) with PoC

More from this source