Description
RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The stream open handler calls only check_vhost_access; it omits the node/vhost/user connection-limit checks that rabbit_reader performs for AMQP. A developer %% FIXME comment at the cited line explicitly acknowledges the gap. No compensating enforcement exists in connection tracking or elsewhere in rabbitmq_stream. An authenticated tenant can fully bypass operator-configured per-user and per-vhost connection caps by connecting via port 5552 instead of 5672. Preconditions include rabbitmq_stream plugin enabled Authenticated stream-protocol credentials Operator relies on per-user/per-vhost connection limits for tenant isolation. This issue is fixed in versions 4.2.7 and 4.3.1.
Published: 2026-09-23
Score: 6 Medium
EPSS: n/a
KEV: No
Impact: Bypass of Operator-Configured Connection Limits
Action: Immediate Patch
AI Analysis

Impact

The vulnerability allows an authenticated tenant to open stream connections through port 5552 that skip the per-vhost and per-user connection‑limit checks in the stream protocol. As a result, the tenant can exceed the operator‑enforced caps, potentially exhausting broker resources and affecting other tenants. The flaw is a classic resource exhaustion and isolation breach (CWE-770).

Affected Systems

RabbitMQ Server, versions prior to 4.2.7 and 4.3.1. Any deployment with the rabbitmq_stream plugin enabled and operator‑configured per‑user/per‑vhost limits is affected.

Risk and Exploitability

The CVSS score is 6, indicating a medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation. The likely attack vector is an authenticated user connecting via the stream protocol on port 5552, leveraging normal credentials and bypassing normal throttling mechanisms.

Generated by OpenCVE AI on September 23, 2026 at 21:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade RabbitMQ Server to version 4.2.7 or 4.3.1 where the stream connection limits are enforced properly.
  • If upgrading is not immediately possible, disable the rabbitmq_stream plugin or block inbound traffic to port 5552 to prevent the bypass.
  • Re‑validate that per‑user and per‑vhost connection limits are properly enabled and enforce additional monitoring of connection counts across protocols.

Generated by OpenCVE AI on September 23, 2026 at 21:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Description RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The stream open handler calls only check_vhost_access; it omits the node/vhost/user connection-limit checks that rabbit_reader performs for AMQP. A developer %% FIXME comment at the cited line explicitly acknowledges the gap. No compensating enforcement exists in connection tracking or elsewhere in rabbitmq_stream. An authenticated tenant can fully bypass operator-configured per-user and per-vhost connection caps by connecting via port 5552 instead of 5672. Preconditions include rabbitmq_stream plugin enabled Authenticated stream-protocol credentials Operator relies on per-user/per-vhost connection limits for tenant isolation. This issue is fixed in versions 4.2.7 and 4.3.1.
Title RabbitMQ: Stream protocol skips per vhost per user connection limits
Weaknesses CWE-770
References
Metrics cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-23T20:12:00.076Z

Reserved: 2026-07-23T23:25:28.897Z

Link: CVE-2026-66067

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-23T21:16:58.783

Modified: 2026-09-23T21:16:58.783

Link: CVE-2026-66067

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T21:30:07Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling