BSI warns of multiple RabbitMQ flaws enabling DoS and info disclosure

1. Executive summary

Germany's BSI published advisory WID-SEC-2026-4143 on 2026-10-26, rated hoch (high), stating that an attacker can exploit multiple vulnerabilities in RabbitMQ to cause a denial of service or disclose information. The advisory gives no CVE identifiers, no affected version ranges, no CVSS scores and no vendor fix. No CVE in this item has a resolved NVD record, EPSS score or CISA KEV entry, so the exploitation status is unknown rather than confirmed or ruled out. RabbitMQ is common message-broker middleware in EMEA payment, settlement and trade-processing estates, where a broker outage stalls the queues behind it. The risk to a client is availability of message flow and possible disclosure of message content, not remote code execution as described.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

3. Technical analysis & attack chain

The source is a one-line BSI summary. It confirms the affected product (RabbitMQ), the impact classes (denial of service, information disclosure) and the BSI severity (hoch). It does not name the vulnerabilities, the affected versions, the attack vector, the authentication requirement or the fix. Everything below the impact classes is therefore not established by the source and is flagged as such.

What the source supports:

An attacker exploits one or more unspecified flaws in RabbitMQ.
The outcome is a denial-of-service condition, disclosure of information, or both.

What the source does not support, and which an analyst must obtain from the RabbitMQ security page or the upstream Erlang/OTP advisories before acting: the CVE identifiers, the affected and fixed versions, whether exploitation needs an authenticated management or AMQP user, and whether the DoS is broker-wide or limited to a single queue or connection. No attack chain can be written from generic vector descriptions without inventing detail, so none is given here.

The related BSI advisories in the same batch cover Apache ActiveMQ Artemis, MISP, dnsmasq, JupyterHub and Wireshark. They are separate products with separate flaws and are not part of this RabbitMQ item. Their presence in the same feed indicates a busy BSI publication window, not a shared vulnerability or a linked campaign. No actor, tooling or infrastructure is named in any of them, and no MITRE ATT&CK profile applies.

Confidence: the impact classes and severity rest on a single source (BSI WID-SEC-2026-4143). Treat the technical scope as unconfirmed until the RabbitMQ vendor advisory is read.

4. Mitigation & containment

P1 (within 24h)

Identify every RabbitMQ broker in the estate, including containerised and managed instances, and record its version. The source gives no fixed version, so the target version must come from the RabbitMQ security page, not from this advisory.
Restrict network reachability to the AMQP port (5672), the management UI and API (15672) and the clustering ports to known hosts. The management interface exposed to a wider network is the usual path to an unauthenticated DoS on a broker.
Confirm the default guest account is not reachable from off-host and that per-user permissions follow least privilege, so an information-disclosure flaw cannot be reached by a low-privilege account.

P2 (within 72h)

Apply the vendor fix once the RabbitMQ security page names the affected and fixed versions. If no fix exists yet, pin to the last version the vendor lists as unaffected and record the decision.
Set resource alarms and memory/disk watermarks so a queue flood triggers flow control rather than broker failure, and alert on queue depth and connection-count spikes.
Review broker logs for abnormal connection churn, repeated authentication failures and management API errors that precede a restart.

P3 (within 7 days)

Add RabbitMQ to the patch cycle with a named owner, given that this is the second message-broker advisory in the same BSI batch (ActiveMQ Artemis, WID-SEC-2026-3289).
Test failover of clustered brokers so a single-node DoS does not take the queue offline.

5. Indicators of compromise

No indicators of compromise available in the source material. The BSI advisory gives no hashes, network indicators, file paths or behavioural detail.

6. Detection

Insufficient indicators to author detection rules.

7. Sources

BSI Germany, [NEU] [hoch] RabbitMQ: Mehrere Schwachstellen (WID-SEC-2026-4143), https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4143, 2026-10-26.
BSI Germany, [NEU] [hoch] Apache ActiveMQ Artemis: Mehrere Schwachstellen (WID-SEC-2026-3289), https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3289, date not given in the feed.
BSI Germany, [NEU] [hoch] MISP: Mehrere Schwachstellen (WID-SEC-2026-3490), https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3490, date not given in the feed.
BSI Germany, [NEU] [hoch] MISP: Mehrere Schwachstellen (WID-SEC-2026-3173), https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3173, date not given in the feed.
BSI Germany, [UPDATE] [hoch] dnsmasq: Mehrere Schwachstellen (WID-SEC-2026-1468), https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1468, date not given in the feed.
BSI Germany, [NEU] [hoch] JupyterHub: Mehrere Schwachstellen (WID-SEC-2026-4095), https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4095, date not given in the feed.
BSI Germany, [UPDATE] [hoch] Wireshark: Mehrere Schwachstellen (WID-SEC-2026-1311), https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1311, date not given in the feed.

8. Adverse Trace position

Adverse Trace assesses this item as high severity on the BSI rating but with unresolved technical scope: no CVE, version range or fix is published, and no exploitation is recorded in CISA KEV. The client impact is availability of message flow and possible disclosure of message content on RabbitMQ brokers, which in a payments or settlement estate can stall downstream processing. We will pull the RabbitMQ vendor advisory to resolve the CVE set and fixed versions, re-issue this note with a prioritised triage table if more than five CVEs are named, and track the ActiveMQ Artemis advisory in the same batch as a parallel broker exposure. Clients running RabbitMQ should inventory broker versions and restrict management-interface reachability now, before the vendor detail lands.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.