CVE-2026-66076 - Vulnerability Details

- RabbitMQ: Cross-vhost quorum-queue status and stream tracking disclosure

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, is_authorized/2 calls rabbit_mgmt_util:is_authorized/2, which checks only the management tag, instead of is_authorized_vhost/2. The /api/queues/quorum/:vhost/:queue/status handler reads the vhost from the path without checking that the user can access it. Any management-tagged user can therefore read Raft status, including leader, members, term, and commit index, for quorum queues in inaccessible vhosts, exposing cross-tenant queue names and cluster topology. The management plugin must be enabled and the attacker must have a management tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

Published: 2026-09-23

Score: 2.3 Low

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

RabbitMQ allows a user who has a management tag to retrieve the status of quorum queues in any virtual host through the /api/queues/quorum/:vhost/:queue/status endpoint. The endpoint reads the virtual host from the request path and performs no authorization check against the user’s access rights to that virtual host. As a result, the leader, members, Raft term, and commit index for quorum queues become visible to the attacker, revealing cross‑tenant queue names and the cluster topology. The flaw is a weakness in authorization checks (CWE-862) combined with improper validation of user intent (CWE-639).

Affected Systems

RabbitMQ Server versions before 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 are impacted. The vulnerability resides in the management plugin of the rabbitmq-server product and requires that the plugin be enabled.

Risk and Exploitability

The CVSS score of 2.3 indicates a low severity impact. Exploitation requires a user with a management tag and an enabled management interface, limiting the attack to existing privileged users. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation is unlikely but still plausible within an organization that has such users.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

rabbitmq

rabbitmq-server

affected

Version	Status	Constraints
`>= 3.13.0, < 3.13.15`	affected	—
`>= 4.0.0, < 4.0.20`	affected	—
`>= 4.1.0, < 4.1.11`	affected	—
`>= 4.2.0, < 4.2.6`	affected	—

No data.

Vendor Product Confidence Versions

Rabbitmq

Rabbitmq-server

100%

Version	Status	Scheme	Platform
`[3.13.0,3.13.15)`	affected	semver	—
`[4.0.0,4.0.20)`	affected	semver	—
`[4.1.0,4.1.11)`	affected	semver	—
`[4.2.0,4.2.6)`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade RabbitMQ to at least version 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.0, which contains the authorization fix.
Disable or restrict the RabbitMQ management interface for users who do not need management tags, or remove the management tag from those users.
Review and enforce vhost‑level permissions so that users can only access the virtual hosts they are authorized to manage.

Generated by OpenCVE AI on September 24, 2026 at 13:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00265.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6
https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-j45q-v7g2-82ph
https://nvd.nist.gov/vuln/detail/CVE-2026-66076
https://www.cve.org/CVERecord?id=CVE-2026-66076

History

Thu, 24 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 24 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-639
References		https://nvd.nist.gov/vuln/detail/CVE-2026-66076 https://www.cve.org/CVERecord?id=CVE-2026-66076
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}` threat_severity `Moderate`

Wed, 23 Sep 2026 22:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Rabbitmq Rabbitmq rabbitmq-server
Vendors & Products		Rabbitmq Rabbitmq rabbitmq-server

Wed, 23 Sep 2026 20:15:00 +0000

Type	Values Removed	Values Added
Description		RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, is_authorized/2 calls rabbit_mgmt_util:is_authorized/2, which checks only the management tag, instead of is_authorized_vhost/2. The /api/queues/quorum/:vhost/:queue/status handler reads the vhost from the path without checking that the user can access it. Any management-tagged user can therefore read Raft status, including leader, members, term, and commit index, for quorum queues in inaccessible vhosts, exposing cross-tenant queue names and cluster topology. The management plugin must be enabled and the attacker must have a management tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
Title		RabbitMQ: Cross-vhost quorum-queue status and stream tracking disclosure
Weaknesses		CWE-862
References		https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6 https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-j45q-v7g2-82ph
Metrics		cvssV4_0 `{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}`

Subscriptions

Rabbitmq Rabbitmq-server

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2026-09-23T19:57:11.906Z

Updated: 2026-09-24T14:31:26.020Z

Reserved: 2026-07-23T23:25:28.898Z

Link: CVE-2026-66076

Vulnrichment

Updated: 2026-09-24T14:31:22.844Z

NVD

Status : Awaiting Analysis

Published: 2026-09-23T20:17:13.007

Modified: 2026-09-24T15:17:28.493

Link: CVE-2026-66076

Redhat

Severity : Moderate

Publid Date: 2026-09-23T19:57:11Z

Links: CVE-2026-66076 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-24T14:00:08Z

Weaknesses

CWE-639
Authorization Bypass Through User-Controlled Key
CWE-862
Missing Authorization

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object