Why SolarWinds Observability Self-Hosted and SolarWinds Access Rights Manager (ARM) are not affected by CVE-2026-57215, CVE-2026-57216, CVE-2026-57219, and CVE-2026-57221

In 2026, the National Institute of Standards and Technology (NIST) published security bulletins about CVE-2026-57215, CVE-2026-57216, CVE-2026-57219, and CVE-2026-57221 vulnerabilities affecting RabbitMQ.

CVE-2026-57215 is an authorization bypass affecting RabbitMQ versions prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6. RabbitMQ allows foreign bindings to amq.rabbitmq.reply-to destinations because volatile direct-reply-to queues can be accepted at bind and route time but are missing from Khepri-backed deletion checks, leaving persistent route entries after unbind. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

CVE-2026-57216 is an authentication bypass vulnerability affecting RabbitMQ versions prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6. MQP 0-9-1, AMQP 1.0, and Stream Protocol authentication can allow a loopback-restricted user such as guest to connect remotely when traffic is accepted through a trusted PROXY-protocol path and the backend listener is loopback-bound because the loopback check uses the listener-side socket address instead of the real client source. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

CVE-2026-57219 is a sensitive information disclosure vulnerability affecting RabbitMQ versions prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6. The obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauth_client_secret, exposing credentials to unauthenticated callers when the management plugin and that OAuth configuration are enabled. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

CVE-2026-57221 is another authorization bypass vulnerability affecting RabbitMQ versions prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6. RabbitMQ does not perform authorization checks on passive queue.declare and exchange.declare AMQP 0-9-1 operations, allowing any authenticated user who can connect to a virtual host to enumerate queue and exchange names and read queue message and consumer counts. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

SolarWinds Observability Self-Hosted does not utilize the RabbitMQ configurations or functionality required to exploit the vulnerabilities listed above. The same rationale applies to SolarWinds Access Rights Manager (ARM). Therefore, CVE-2026-57215, CVE-2026-57216, CVE-2026-57219, and CVE-2026-57221 do not affect ARM or SolarWinds Observability Self-Hosted.