CVE-2026-57211 Overview
CVE-2026-57211 is a path traversal vulnerability in the RabbitMQ management plugin on Windows. The flaw resides in the rabbit_mgmt_wm_static static file handler, which passes URL-encoded backslashes to erl_prim_loader:read_file_info before path validation occurs. When multiple management extension plugins are enabled, an unauthenticated attacker can trigger outbound DNS and SMB requests to attacker-controlled Universal Naming Convention (UNC) paths. The vulnerability affects RabbitMQ versions prior to 4.1.11 and 4.2.6 on Windows and is classified under [CWE-36] (Absolute Path Traversal).
Critical Impact
Remote unauthenticated attackers can coerce the RabbitMQ Windows host to initiate SMB connections to attacker-controlled servers, enabling NTLM credential capture and relay attacks against the broker's service account.
Affected Products
- Broadcom RabbitMQ Server versions prior to 4.1.11 (Windows)
- Broadcom RabbitMQ Server versions prior to 4.2.6 (Windows)
- Microsoft Windows hosts running the RabbitMQ management plugin
Discovery Timeline
- 2026-07-10 - CVE-2026-57211 published to the National Vulnerability Database
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-57211
Vulnerability Analysis
The RabbitMQ management plugin exposes a static file handler (rabbit_mgmt_wm_static) that serves assets from the priv directory of registered management extension applications. On Windows, the handler joined user-controlled PathInfo segments with the application priv directory using filename:join/1 and then invoked erl_prim_loader:read_file_info/1 on the composed path before any validation of the input segments.
Because Erlang's erl_prim_loader accepts UNC paths on Windows, a request containing URL-encoded backslashes such as %5C%5Cattacker.example.com%5Cshare gets normalized into a \\attacker.example.com\share UNC reference. The read_file_info call then triggers a Windows SMB client operation, which performs DNS resolution and a network connection to the attacker-controlled host.
Root Cause
The root cause is missing input validation on request path segments before they are used in a file-system lookup. Path filtering was performed only after the read_file_info call, allowing side effects such as outbound SMB traffic to occur regardless of whether the file access ultimately succeeded.
Attack Vector
Exploitation requires only network access to the RabbitMQ management HTTP interface and no authentication. When multiple management extension plugins are enabled, the handler iterates candidate applications, giving the attacker repeated opportunities to trigger the vulnerable code path. The Windows SMB client automatically attempts NTLM authentication using the RabbitMQ service account, exposing credentials to capture and relay attacks.
init(Req0, [{App, Path}|Tail]) ->
Req1 = rabbit_mgmt_headers:set_common_permission_headers(Req0, ?MODULE),
PathInfo = cowboy_req:path_info(Req1),
- Filepath = filename:join([code:priv_dir(App), Path|PathInfo]),
- %% We use erl_prim_loader because the file may be inside an .ez archive.
- FileInfo = erl_prim_loader:read_file_info(binary_to_list(Filepath)),
- case FileInfo of
- {ok, #file_info{type = regular}} -> do_init(Req1, App, Path);
- {ok, #file_info{type = symlink}} -> do_init(Req1, App, Path);
- _ -> init(Req0, Tail)
+ case validate_path_info(PathInfo) of
+ ok ->
+ Filepath = filename:join([code:priv_dir(App), Path|PathInfo]),
+ %% We use `erl_prim_loader` because the file may be inside
+ %% an .ez archive.
+ FileInfo = erl_prim_loader:read_file_info(
+ binary_to_list(Filepath)),
+ case FileInfo of
+ {ok, #file_info{type = regular}} ->
+ do_init(Req1, App, Path);
+ {ok, #file_info{type = symlink}} ->
+ do_init(Req1, App, Path);
+ _ ->
+ init(Req0, Tail)
+ end;
+ error ->
+ init(Req0, Tail)
end.
Source: RabbitMQ commit 39c3a8e9. The patch introduces validate_path_info/1, which inspects request path segments before any file-system call, rejecting encoded backslashes and other traversal sequences.
Detection Methods for CVE-2026-57211
Indicators of Compromise
- Outbound SMB (TCP/445) or NetBIOS (TCP/139) connections originating from the RabbitMQ Windows host to untrusted external or internal destinations.
- DNS queries from the RabbitMQ host resolving unusual hostnames referenced in HTTP management URLs.
- HTTP requests to the management plugin containing %5C%5C, %2f%2f, or other URL-encoded path separators followed by hostnames.
Detection Strategies
- Inspect the RabbitMQ management HTTP access logs for requests whose paths include encoded backslashes, encoded forward slashes, or embedded hostnames.
- Correlate management-plugin request timestamps with SMB or DNS egress events from the RabbitMQ host to identify triggered UNC lookups.
- Alert on any process owned by the RabbitMQ service account initiating SMB traffic to non-approved file servers.
Monitoring Recommendations
- Enable NetLogon and SMB client event logging on Windows hosts running RabbitMQ and forward events to a central data lake.
- Baseline expected outbound destinations from RabbitMQ nodes so that new SMB or DNS peers surface as anomalies.
- Track version metadata from RabbitMQ clusters via configuration management tooling to identify hosts still running vulnerable builds.
How to Mitigate CVE-2026-57211
Immediate Actions Required
- Upgrade RabbitMQ to version 4.1.11, 4.2.6, or later on all Windows nodes running the management plugin.
- Restrict inbound access to the management HTTP listener (default TCP/15672) to trusted administrative networks only.
- Block outbound SMB (TCP/139, TCP/445) from RabbitMQ Windows hosts to the internet at the network perimeter.
Patch Information
Fixes are available in RabbitMQ 4.1.11 and 4.2.6. The remediation adds a validate_path_info/1 guard that rejects path segments containing traversal sequences before the handler calls erl_prim_loader:read_file_info. See the GitHub Security Advisory GHSA-7v84-m3g5-vxq6, pull request #15803, and the v4.2.6 release notes for details.
Workarounds
- Disable the RabbitMQ management plugin on Windows nodes until the patched version can be deployed.
- Disable any non-essential management extension plugins, since the vulnerable code path activates when multiple extensions are registered.
- Enforce host-based firewall rules that deny outbound SMB from the RabbitMQ service account.
# Disable the management plugin as a temporary workaround
rabbitmq-plugins disable rabbitmq_management
# Verify upgraded version after patching
rabbitmqctl version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
