Description
RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The stream open handler calls only check_vhost_access; it omits the node/vhost/user connection-limit checks that rabbit_reader performs for AMQP. A developer %% FIXME comment at the cited line explicitly acknowledges the gap. No compensating enforcement exists in connection tracking or elsewhere in rabbitmq_stream. An authenticated tenant can fully bypass operator-configured per-user and per-vhost connection caps by connecting via port 5552 instead of 5672. Preconditions include rabbitmq_stream plugin enabled Authenticated stream-protocol credentials Operator relies on per-user/per-vhost connection limits for tenant isolation. This issue is fixed in versions 4.2.7 and 4.3.1.
Published: 2026-09-23
Score: 6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Bypass of Operator-Configured Connection Limits
Action: Immediate Patch
AI Analysis

Impact

The vulnerability allows an authenticated tenant to open stream connections through port 5552 that skip the per-vhost and per-user connection‑limit checks in the stream protocol. As a result, the tenant can exceed the operator‑enforced caps, potentially exhausting broker resources and affecting other tenants. The flaw is a classic resource exhaustion and isolation breach (CWE-770, CWE-1220).

Affected Systems

RabbitMQ Server, versions prior to 4.2.7 and 4.3.1. Any deployment with the rabbitmq_stream plugin enabled and operator‑configured per‑user/per‑vhost limits is affected.

Risk and Exploitability

The CVSS score is 6, indicating a medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation. The likely attack vector is an authenticated user connecting via the stream protocol on port 5552, leveraging normal credentials and bypassing normal throttling mechanisms.

Generated by OpenCVE AI on September 24, 2026 at 01:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade RabbitMQ Server to version 4.2.7 or 4.3.1 where the stream connection limits are enforced properly.
  • If upgrading is not immediately possible, disable the rabbitmq_stream plugin or block inbound traffic to port 5552 to prevent the bypass.
  • Re‑validate that per‑user and per‑vhost connection limits are properly enabled and enforce additional monitoring of connection counts across protocols.

Generated by OpenCVE AI on September 24, 2026 at 01:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 05:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 24 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1220
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Wed, 23 Sep 2026 23:00:00 +0000

Type Values Removed Values Added
First Time appeared Rabbitmq
Rabbitmq rabbitmq-server
Vendors & Products Rabbitmq
Rabbitmq rabbitmq-server

Wed, 23 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Description RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The stream open handler calls only check_vhost_access; it omits the node/vhost/user connection-limit checks that rabbit_reader performs for AMQP. A developer %% FIXME comment at the cited line explicitly acknowledges the gap. No compensating enforcement exists in connection tracking or elsewhere in rabbitmq_stream. An authenticated tenant can fully bypass operator-configured per-user and per-vhost connection caps by connecting via port 5552 instead of 5672. Preconditions include rabbitmq_stream plugin enabled Authenticated stream-protocol credentials Operator relies on per-user/per-vhost connection limits for tenant isolation. This issue is fixed in versions 4.2.7 and 4.3.1.
Title RabbitMQ: Stream protocol skips per vhost per user connection limits
Weaknesses CWE-770
References
Metrics cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Rabbitmq Rabbitmq-server
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-24T14:11:44.566Z

Reserved: 2026-07-23T23:25:28.897Z

Link: CVE-2026-66067

cve-icon Vulnrichment

Updated: 2026-09-24T14:11:37.335Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-23T21:16:58.783

Modified: 2026-09-24T15:02:58.307

Link: CVE-2026-66067

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-23T20:12:00Z

Links: CVE-2026-66067 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-24T01:30:12Z

Weaknesses
  • CWE-1220

    Insufficient Granularity of Access Control

  • CWE-770

    Allocation of Resources Without Limits or Throttling