CVE-2026-57211

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6

Description On Windows, the RabbitMQ management plugin static file handler rabbit mgmt wm static can pass URL-encoded backslashes to the erl prim loader:read file info() function before path validation occurs. This happens when multiple management extension plugins are enabled, allowing the system to trigger outbound DNS and SMB requests to attacker-controlled UNC (Universal Naming Convention) paths.

Recommendations Update to version 4.1.11. Update to version 4.2.6.