Every CVE Search/ Get API key

CVE-2026-57211

RabbitMQ: UNC SSRF affecting the management UI on Windows

6.5 MediumFix available

RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbit_mgmt_wm_static can pass URL-encoded backslashes to erl_prim_loader:read_file_info before path validation when multiple management extension plugins are enabled, causing outbound DNS and SMB requests to attacker-controlled UNC paths. This issue is fixed in versions 4.1.11 and 4.2.6.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
Low
Availability
None

Exploit likelihood

0.63%Up 0.4 points since Jul 11, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.5

RabbitMQ: UNC SSRF affecting the management UI on Windows

RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbit_mgmt_wm_static can pass URL-encoded backslashes to erl_prim_loader:read_file_info before path validation when multiple management extension plugins are enabled, causing outbound DNS and SMB requests to attacker-controlled UNC paths. This issue is fixed in versions 4.1.11 and 4.2.6.

Record
CVE-2026-57211
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Weakness
CWE-36, CWE-918
Updated
2026-11-02
EUVDEUVD-2026-43016 6.5

RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbit_mgmt_wm_static can pass URL-encoded backslashes to erl_prim_loader:read_file_info before path validation when multiple management extension plugins are enabled, causing outbound DNS and SMB requests to attacker-controlled UNC paths. This issue is fixed in versions 4.1.11 and 4.2.6.

Record
EUVD-2026-43016
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
NVD 6.5

RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbit_mgmt_wm_static can pass URL-encoded backslashes to erl_prim_loader:read_file_info before path validation when multiple management extension plugins are enabled, causing outbound DNS and SMB requests to attacker-controlled UNC paths. This issue is fixed in versions 4.1.11 and 4.2.6.

Record
CVE-2026-57211
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-36, CWE-918
Updated
2026-11-02
OSV 6.5

RabbitMQ: UNC SSRF affecting the management UI on Windows

RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbit_mgmt_wm_static can pass URL-encoded backslashes to erl_prim_loader:read_file_info before path validation when multiple management extension plugins are enabled, causing outbound DNS and SMB requests to attacker-controlled UNC paths. This issue is fixed in versions 4.1.11 and 4.2.6.

Record
CVE-2026-57211
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Weakness
CWE-36, CWE-918
Updated
2026-11-02
OSVRHSA-2026:35939 10.0

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:35939
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:35940 10.0

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:35940
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-57211 6.5

RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbit_mgmt_wm_static can pass URL-encoded backslashes to erl_prim_loader:read_file_info before path validation when multiple management extension plugins are enabled, causing outbound DNS and SMB requests to attacker-controlled UNC paths. This issue is fixed in versions 4.1.11 and 4.2.6.

Record
UBUNTU-CVE-2026-57211
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-92361 No score

CVE-2026-57211 affecting package rabbitmq-server for versions less than 3.13.7-8

RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbit_mgmt_wm_static can pass URL-encoded backslashes to erl_prim_loader:read_file_info before path validation when multiple management extension plugins are enabled, causing outbound DNS and SMB requests to attacker-controlled UNC paths. This issue is fixed in versions 4.1.11 and 4.2.6.

Record
AZL-92361
Updated
2026-11-05

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rabbitmq-server
Azure Linux:3
 before 3.13.7-8
3.13.7-8
rabbitmq-server4.3
Red Hat:hummingbird:1
From an advisory covering 11 CVEs
 before 0:4.3.2-1.hum1
0:4.3.2-1.hum1
rabbitmq-server4.2
Red Hat:hummingbird:1
From an advisory covering 11 CVEs
 before 0:4.2.8-1.hum1
0:4.2.8-1.hum1
rabbitmq-server
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.5.4-13.5.4-33.5.4-3.13.5.7-13.5.7-1ubuntu0.16.04.1
Show 5 moreShow less
3.5.7-1ubuntu0.16.04.23.5.7-1ubuntu0.16.04.43.5.7-1ubuntu0.16.04.4+esm13.5.7-1ubuntu0.16.04.4+esm23.5.7-1ubuntu0.16.04.4+esm3
 None known
rabbitmq-server
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.6.10-13.6.10-1ubuntu0.13.6.10-1ubuntu0.33.6.10-1ubuntu0.43.6.10-1ubuntu0.53.6.10-1ubuntu0.5+esm1
 None known
rabbitmq-server
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
3.7.8-4ubuntu23.7.18-13.8.2-0ubuntu13.8.2-0ubuntu1.13.8.2-0ubuntu1.2
Show 8 moreShow less
3.8.2-0ubuntu1.33.8.2-0ubuntu1.43.8.2-0ubuntu1.53.8.3-0ubuntu0.13.8.3-0ubuntu0.23.8.3-0ubuntu0.33.8.3-0ubuntu0.3+esm13.8.3-0ubuntu0.3+esm2
 None known
rabbitmq-server
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.8.9-3ubuntu13.9.8-13.9.8-23.9.8-33.9.8-5
Show 8 moreShow less
3.9.8-63.9.13-13.9.13-1ubuntu0.22.04.13.9.13-1ubuntu0.22.04.23.9.27-0ubuntu0.13.9.27-0ubuntu0.23.9.27-0ubuntu0.53.9.27-0ubuntu0.6
 None known
rabbitmq-server
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.12.1-13.12.1-1ubuntu13.12.1-1ubuntu1.23.12.1-1ubuntu1.43.12.1-1ubuntu1.63.12.1-1ubuntu1.7
 None known
rabbitmq-server
Ubuntu:26.10
 All versions, plus listed versions
4.0.5-10ubuntu54.3.2-4ubuntu24.3.2-4ubuntu3
 None known
rabbitmq-server
Ubuntu:26.04:LTS
 All versions, plus listed versions
4.0.5-8ubuntu24.0.5-10ubuntu14.0.5-10ubuntu24.0.5-10ubuntu34.0.5-10ubuntu44.0.5-10ubuntu54.0.5-10ubuntu5.14.0.5-10ubuntu5.2
 None known

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-57211 is a medium vulnerability (CVSS 6.5) in Broadcom Rabbitmq Server, published July 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.63%, the 50th percentile. Fixed in rabbitmq-server 3.13.7-8.

References

Show 102 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open