🟠 High | Source: Microsoft Security Response Center
CVE-2026-57217 is a vulnerability in RabbitMQ’s topic authorisation mechanism that allows a tenant’s messages to be routed to another tenant’s queues by manipulating routing keys. This breaks the isolation boundary between tenants sharing a RabbitMQ deployment, which is a common pattern in Azure-hosted messaging architectures. An attacker with access to one tenant context could potentially read or inject messages intended for another tenant.
Security Architect’s Take: Audit any multi-tenant RabbitMQ deployments on Azure — particularly those using topic exchanges — and apply vendor patches immediately. As an interim control, consider enforcing strict per-tenant virtual host (vhost) separation rather than relying solely on topic-level authorisation policies.
Original advisory: CVE-2026-57217 RabbitMQ: Topic authorization can lead to cross-tenant routing-key bypass