Disclosure summary
Cantina identified and human-verified this vulnerability in RabbitMQ. The finding was coordinated with the affected maintainer through responsible disclosure before publication.
Direct-reply-to bindings enable cross-tenant injection.
Verification standard
Cantina publishes a disclosure only after reproducing the behavior, validating its security impact, and coordinating remediation with the affected project.