CVE-2026-57211 is a medium severity (CVSS 6.5) server side request forgery in the RabbitMQ management plugin on Windows. Affected: 4.1.0 before 4.1.11 and 4.2.0 before 4.2.6. Upgrade to 4.1.11 or 4.2.6, and review which management extension plugins are enabled. No login is needed, according to the advisory.
What's affected
The RabbitMQ advisory (GHSA-7v84-m3g5-vxq6) says versions from 4.1.0 up to but not including 4.1.11, and from 4.2.0 up to but not including 4.2.6, are affected. Patched: 4.1.11 and 4.2.6.
The issue appears only on Windows, and only when two or more management extension plugins are enabled. The static file handler can pass URL encoded backslashes to a file function before the path is validated. Windows then treats the result as a network path, causing outbound DNS and SMB requests to an address the attacker names.
The advisory says no authentication is needed. On domain joined machines, it says the request can expose the machine account's NTLMv2 hash.
How to check if you're exposed
rabbitmqctl version
rabbitmq-plugins list -e
- Confirm the host runs Windows. Linux nodes are not part of this advisory.
- Check the version against the ranges above.
- Look at the enabled plugin list. If the management plugin and more than one extension plugin are on, the condition is met.
- Check whether the management port is reachable from untrusted networks.
Run the free in-browser dependency scan at https://gold.safeguard.sh/scan against your manifest or lockfile. It lists vulnerable packages without installing anything.
What to do now
- Upgrade RabbitMQ to 4.1.11, 4.2.6 or later.
- Until then, restrict the management port to administrators with firewall rules.
- Block outbound SMB (TCP port 445) from the RabbitMQ host to the internet.
- Disable management extension plugins you do not use.
- Review outbound DNS and SMB logs from the host for unexpected destinations.
Why it matters
The record lists CWE-918, server side request forgery, and CWE-36, absolute path traversal. A request path is handed to the operating system before it is checked, and on Windows a path in a certain form means fetch this from another machine. The server then reaches out on the attacker's behalf.
The danger is the credentials that go with the outbound connection. Blocking outbound SMB at the network edge neutralizes the worst case, whatever the application does. Validate input before it reaches any file function. The record is not in CISA's Known Exploited Vulnerabilities catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is Linux affected?
The advisory describes the issue on Windows. A path form that Windows treats as a network share is the trigger.
Sources
Last reviewed: 19 October 2026.
