Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.3
CVE-2026-66076: RabbitMQ lets management users see other vhost queue details
CVE-2026-66076 · published 26 days ago
Summary
In certain older versions of RabbitMQ, a user with the management role could request information about queues in virtual hosts they are not allowed to access. This reveals internal queue names and cluster layout, which could help an attacker map the system. Upgrade to the latest RabbitMQ release or restrict the management plugin to trusted users.
What to do
- Update debian rabbitmq-server to version 4.3.0-2.
- Update rabbitmq to version 4.2.6.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | rabbitmq | rabbitmq-server | >= 3.13.0, < 3.13.15 |
| Ubuntu:Pro:16.04:LTS | canonical | rabbitmq-server | All versions |
| Debian:12 | debian | rabbitmq-server | All versions |
| Debian:14 | debian | rabbitmq-server |
< 4.3.0-2 Fix: upgrade to 4.3.0-2
|
| Bitnami | – | rabbitmq |
>= 4.2.0, < 4.2.6 Fix: upgrade to 4.2.6
|
| – | broadcom | rabbitmq_server |
>= 3.13.0, < 3.13.15 >= 4.0.0, < 4.0.20 >= 4.1.0, < 4.1.11 >= 4.2.0, < 4.2.6 cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:* |
Original advisory text
RabbitMQ: Cross-vhost quorum-queue status and stream tracking disclosure
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, is_authorized/2 calls rabbit_mgmt_util:is_authorized/2, which checks only the management tag, instead of is_authorized_vhost/2. The /api/queues/quorum/:vhost/:queue/status handler reads the vhost from the path without checking that the user can access it. Any management-tagged user can therefore read Raft status, including leader, members, term, and commit index, for quorum queues in inaccessible vhosts, exposing cross-tenant queue names and cluster topology. The management plugin must be enabled and the attacker must have a management tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
References
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6 Release Notes
- https://ubuntu.com/security/CVE-2026-66076 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-66076 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-66076 Vendor Advisory
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-j45q-v7g2-8... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66076... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-66076 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-862Missing Authorization
Timeline
Published23 Sep 2026
Updated19 Oct 2026
First seen23 Sep 2026
Sources
CVE-2026-66076 · NVD
CVE-2026-66076 · MITRE
UBUNTU-CVE-2026-66076 · OSV
DEBIAN-CVE-2026-66076 · OSV
CVE-2026-66076 · OSV
GHSA-j45q-v7g2-82ph · GHSA
BIT-rabbitmq-2026-66076 · OSV
Track software like this
Free during beta