Vulnerabilidades em rabbitmq
100 resultadosAnálise Vexday
RabbitMQ acumula 21 vulnerabilidades conhecidas na base Vexday, com destaque preocupante: 13 foram publicadas nos últimos 90 dias, sinalizando descobertas recentes e potencial de exploração. Nenhuma está em ataque ativo documentado (KEV), mas a ausência de críticas CVSS não reduz o risco, visto que a fraqueza dominante (CWE-863 — verificação inadequada de autorização) afeta componentes de acesso e controle. O ritmo acelerado de divulgações recentes recomenda priorização de patches e auditoria de permissões nas implementações.
CVE-2026-57221MEDIUMRabbitMQ: Passive queue/exchange declaration bypasses authorization checks, leaking queue metadata to unprivileged usersEPSS 0.4%CVE-2026-67410HIGHRabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript EndpointEPSS 0.4%CVE-2026-67418MEDIUMRabbitMQ MQTT 5: inapplicable PUBLISH property disconnects matching subscribersEPSS 0.4%CVE-2022-31008MEDIUMPredictable credential obfuscation seed value used in rabbitmq-serverEPSS 0.4%CVE-2026-67232HIGHRabbitMQ: Web-MQTT decompression bombEPSS 0.4%CVE-2026-67226MEDIUMRabbitMQ: Admin-only atom exhaustion: PUT /api/users tags listEPSS 0.4%CVE-2026-67229MEDIUMRabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadataEPSS 0.4%CVE-2026-67238HIGHRabbitMQ: Atom-table exhaustion via reply-to queue name decodingEPSS 0.4%CVE-2026-66074MEDIUMRabbitMQ: ReDoS via management API ?name= filterEPSS 0.4%CVE-2026-67415MEDIUMRabbitMQ: Shovel Management Atom Exhaustion Allows Persistent Broker-Wide Denial of ServiceEPSS 0.4%CVE-2026-57215HIGHRabbitMQ: Direct-reply-to binding persistence can lead to unauthorized reply-channel injection and persistent phantomEPSS 0.4%CVE-2026-67227MEDIUMRabbitMQ: Atom exhaustion: to_atom on global-parameter :nameEPSS 0.4%CVE-2026-67419HIGHRabbitMQ: Consecutive topic wildcards cause combinatorial routing workEPSS 0.4%CVE-2026-67218LOWRabbitMQ: Super-stream HTTP creation skips configure-permission checkEPSS 0.4%CVE-2026-66070HIGHRabbitMQ: CORS * reflects Origin with Allow-CredentialsEPSS 0.4%CVE-2026-67240LOWRabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcardEPSS 0.4%CVE-2024-51988MEDIUMHTTP API's queue deletion endpoint does not verify that the user has a required permissionEPSS 0.4%CVE-2026-67223MEDIUMRabbitMQ: LDAP DN injection via unescaped substitutionEPSS 0.4%CVE-2026-67224LOWRabbitMQ: Admin path-traversal write via trace nameEPSS 0.4%CVE-2026-57217HIGHRabbitMQ: Topic authorization can lead to cross-tenant routing-key bypassEPSS 0.4%