Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.3
CVE-2026-66075: RabbitMQ server monitoring user can restart federation links
CVE-2026-66075 · published 26 days ago
Summary
In certain older versions of RabbitMQ server, a user who only has monitoring permissions can trigger a restart of federation links, which moves messages between brokers. This can interrupt the flow of data even though the user should only be able to view status. Upgrade to the latest RabbitMQ release or remove the monitoring tag from users who should not control federation links.
What to do
- Update debian rabbitmq-server to version 4.3.2-1.
- Update rabbitmq to version 4.3.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | rabbitmq | rabbitmq-server | >= 3.13.0, < 3.13.15 |
| Ubuntu:Pro:16.04:LTS | canonical | rabbitmq-server | All versions |
| Debian:12 | debian | rabbitmq-server | All versions |
| Debian:14 | debian | rabbitmq-server |
< 4.3.2-1 Fix: upgrade to 4.3.2-1
|
| Bitnami | – | rabbitmq |
>= 4.3.0, < 4.3.1 Fix: upgrade to 4.3.1
|
| – | broadcom | rabbitmq_server |
>= 4.0.0, < 4.0.20 >= 4.1.0, < 4.1.11 >= 4.2.0, < 4.2.6 >= 4.3.0, < 4.3.1 >= 3.13.0, < 3.13.15 cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:* |
Original advisory text
RabbitMQ: Monitoring-tag user can restart federation links
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, is_authorized/2 for the /federation-links/.../restart route uses is_authorized_monitor (accepts the monitoring tag), while allowed_methods permits DELETE and delete_resource/2 triggers rabbit_federation_link_sup:restart. There is no per-method elevation check and no comment marking it intentional. A read-only monitoring user can restart any federation link , a state-changing operation that disrupts message flow. Preconditions include rabbitmq_federation + rabbitmq_federation_management plugins enabled Attacker has credentials with the monitoring tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.
References
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6 Release Notes
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1 Release Notes
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-g5v3-w5xg-6... Vendor Advisory
- https://ubuntu.com/security/CVE-2026-66075 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-66075 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-66075 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-66075 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66075... Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-862Missing Authorization
Timeline
Published23 Sep 2026
Updated19 Oct 2026
First seen23 Sep 2026
Sources
CVE-2026-66075 · OSV
CVE-2026-66075 · NVD
CVE-2026-66075 · MITRE
UBUNTU-CVE-2026-66075 · OSV
DEBIAN-CVE-2026-66075 · OSV
GHSA-g5v3-w5xg-62q2 · GHSA
BIT-rabbitmq-2026-66075 · OSV
Track software like this
Free during beta