Missing Authorization in RabbitMQ Server - #VU139291
Published: July 24, 2026
Vulnerability details
The vulnerability allows a remote user to disclose messages across virtual host boundaries and cause limited message loss.
The vulnerability exists due to missing authorization in federation upstream URI validation when processing an empty-host direct federation-upstream URI. A remote user can create a crafted federation-upstream configuration and attach a consumer to read and drain messages from another vhost to disclose messages across virtual host boundaries and cause limited message loss.
With the default ack-mode, messages are consumed from the source queue rather than copied. Exploitation requires control of a vhost where the user has policymaker permissions, and queue federation is triggered when a downstream consumer is attached.