RabbitMQ server versions 4.0.0 through before 4.3.3, 4.2.9, 4.1.14, and 4.0.23 contain an improper authorization vulnerability (CWE-285) in the AMQP 1.0 HTTP-over-AMQP management endpoint GET /bindings. This endpoint exposes the full binding topology of the caller's virtual host to any authenticated AMQP 1.0 user without performing resource-level permission checks. Unlike other management operations that enforce permission checks, this GET handler returns the complete binding list regardless of the user's management or monitoring privileges. Consequently, an authenticated AMQP 1.0 client without management roles can enumerate all bindings (source exchanges, destination queues/exchanges, routing keys, and binding arguments) within the accessible virtual host. The vulnerability is addressed in rabbitmq-server versions 4.3.3, 4.2.9, 4.1.14, and 4.0.23.

The vulnerability allows any authenticated AMQP 1.0 user to gain unauthorized visibility into the complete routing topology of a virtual host they can connect to. This disclosure of binding information could aid an attacker in understanding message routing and architecture, potentially facilitating further attacks or information gathering. However, it does not grant direct control or modification capabilities. The CVSS 4.0 base score is 6.3 (medium severity), reflecting network attack vector, low attack complexity, and low privileges required.

A fix is available and has been released in rabbitmq-server versions 4.3.3, 4.2.9, 4.1.14, and 4.0.23. Users should upgrade to these versions or later to remediate this vulnerability. No additional mitigation steps are indicated beyond applying the official patches.