🟠 High | Source: Microsoft Security Response Center
CVE-2026-57215 is a vulnerability in RabbitMQ’s direct-reply-to feature, where persistent bindings can be exploited to inject unauthorised reply channels, creating ‘phantom’ queues or consumers that persist beyond their intended lifecycle. This could allow an attacker to intercept or manipulate message traffic within a RabbitMQ-backed system. Given the widespread use of RabbitMQ in Azure-hosted microservices and event-driven architectures, the potential for message interception or data leakage is significant.
Security Architect’s Take: Audit RabbitMQ deployments on Azure for misconfigured direct-reply-to bindings and enforce strict vhost-level access controls to limit which principals can create or persist bindings. Consider applying available patches immediately and monitor for unexpected queue or binding creation as an indicator of exploitation.
Original advisory: CVE-2026-57215 RabbitMQ: Direct-reply-to binding persistence can lead to unauthorized reply-channel injection and persistent phantom