Description
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, is_authorized/2 calls rabbit_mgmt_util:is_authorized/2, which checks only the management tag, instead of is_authorized_vhost/2. The /api/queues/quorum/:vhost/:queue/status handler reads the vhost from the path without checking that the user can access it. Any management-tagged user can therefore read Raft status, including leader, members, term, and commit index, for quorum queues in inaccessible vhosts, exposing cross-tenant queue names and cluster topology. The management plugin must be enabled and the attacker must have a management tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
Published: 2026-09-23
Score: 2.3 Low
EPSS: n/a
KEV: No
Impact: Information Disclosure
Action: Apply Patch
AI Analysis

Impact

A vulnerability in RabbitMQ allows a user with a management tag to read quorum‑queue status for queues in any vhost, because the /api/queues/quorum/:vhost/:queue/status endpoint does not verify that the user can access the specified vhost. The exposed information includes leader, members, Raft term, and commit index, revealing cross‑tenant queue names and cluster topology. This flaw is an authorization bypass (CWE-862).

Affected Systems

RabbitMQ Server. Versions before 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 are affected. The product is rabbitmq-server and the vulnerability exists in the management plugin.

Risk and Exploitability

The CVSS score of 2.3 indicates a low‑severity impact. Because the exploit requires the management plugin to be enabled and the attacker to possess a management tag, the attack vector is limited to users who already have management‑level access. EPSS is not available and the vulnerability is not listed in CISA KEV, suggesting that exploitation in the wild is unlikely but still possible within an organization where such users exist.

Generated by OpenCVE AI on September 23, 2026 at 21:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade RabbitMQ to at least version 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.0, which includes the authorization fix.
  • Disable or restrict the RabbitMQ management interface for users who do not require management tags, or remove the management tag from those users.
  • Review and enforce vhost‑level permissions so that users only have access to the vhosts they are authorized to manage.

Generated by OpenCVE AI on September 23, 2026 at 21:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, is_authorized/2 calls rabbit_mgmt_util:is_authorized/2, which checks only the management tag, instead of is_authorized_vhost/2. The /api/queues/quorum/:vhost/:queue/status handler reads the vhost from the path without checking that the user can access it. Any management-tagged user can therefore read Raft status, including leader, members, term, and commit index, for quorum queues in inaccessible vhosts, exposing cross-tenant queue names and cluster topology. The management plugin must be enabled and the attacker must have a management tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
Title RabbitMQ: Cross-vhost quorum-queue status and stream tracking disclosure
Weaknesses CWE-862
References
Metrics cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-23T19:57:11.906Z

Reserved: 2026-07-23T23:25:28.898Z

Link: CVE-2026-66076

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-23T20:17:13.007

Modified: 2026-09-23T20:17:13.007

Link: CVE-2026-66076

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T21:30:07Z

Weaknesses