RabbitMQ messaging broker versions before 3.13.15, 4.0.20, 4.1.11, and 4.2.6 lack authorization checks on passive queue.declare and exchange.declare AMQP 0-9-1 operations. This vulnerability permits any authenticated user with access to a virtual host to enumerate queue and exchange names and obtain message and consumer counts from queues. The vulnerability is addressed by implementing proper authorization checks in the fixed versions.

Authenticated users who can connect to a RabbitMQ virtual host can enumerate internal queue and exchange names and read message and consumer counts without proper authorization. This information disclosure could aid attackers in reconnaissance but does not directly allow message manipulation or denial of service.

Upgrade RabbitMQ to version 3.13.15, 4.0.20, 4.1.11, or 4.2.6 or later, where the authorization checks on passive queue.declare and exchange.declare operations are properly enforced. No other mitigation is indicated by the vendor advisory.