The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, AMQP 1.0     management GET /bindings exposes full binding topology to any authenticated AMQP user without     resource/management permission checks. the AMQP 1.0 HTTP-over-AMQP management endpoint GET /bindings (the     rabbitamqpmanagement handler) enumerates bindings between an arbitrary source exchange and destination     queue/exchange in the caller's virtual host without performing any resource-level permission check. Unlike     every sibling operation in the same module (which call checkresourceaccess / bindingchecks), the GET     handler ignores the authenticated User and returns the binding list unchanged. As a result, any     authenticated AMQP 1.0 client that can open a management link pair , including users with no     management/monitoring/policymaker/administrator tag , can enumerate the complete binding topology (source     exchanges, destination queues/exchanges, routing keys, and binding arguments) of the virtual host they can     access. The equivalent HTTP management API (GET /api/bindings) Confidentiality impact: a non-management     AMQP 1.0 user can enumerate the complete routing topology of any virtual host it can connect to , every     (source exchange, destination queue/exchange, routing key, binding arguments) This issue is fixed in     versions 4.3.3, 4.2.9, 4.1.14, and 4.0.23. (CVE-2026-61837)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-61837

medium Nessus Plugin ID 350732

Version 1.2