AIKIDO-2025-10388

TL;DR

Affected versions of this package do not restrict the MessageQueue component from binding to all available TCP interfaces (e.g., 0.0.0.0), which exposes the service to external network access by default. This can increase the attack surface, especially if the message queue is intended for internal use only. Without proper binding to a loopback address (e.g., 127.0.0.1) or explicit configuration, remote attackers may be able to interact with or exploit the message queue service, potentially leading to unauthorized access, data leakage, or further attacks depending on the queue’s capabilities and access controls.