Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-67224: RabbitMQ admin can write files outside trace folder

CVE-2026-67224 · published 26 days ago

Summary

If the tracing feature is enabled, an administrator can name a trace log file so that RabbitMQ writes it to any location the server's operating system user can access, such as system directories. This could let an attacker place or overwrite files, potentially affecting system behavior. Update RabbitMQ to the latest release that includes the fix, or disable the tracing plugin if it is not needed.

What to do

Update debian rabbitmq-server to version 4.3.2-1.
Update rabbitmq to version 4.3.1.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	rabbitmq	rabbitmq-server	>= 3.13.0, < 3.13.15
Ubuntu:Pro:16.04:LTS	canonical	rabbitmq-server	All versions
Debian:12	debian	rabbitmq-server	All versions
Debian:14	debian	rabbitmq-server	< 4.3.2-1 Fix: upgrade to 4.3.2-1
Bitnami	–	rabbitmq	>= 4.3.0, < 4.3.1 Fix: upgrade to 4.3.1
–	broadcom	rabbitmq_server	>= 3.13.0, < 3.13.15 >= 4.0.0, < 4.0.20 >= 4.1.0, < 4.1.11 >= 4.2.0, < 4.2.6 >= 4.3.0, < 4.3.1 `cpe:2.3:a:broadcom:rabbitmq_server::::::::`

Original advisory text

RabbitMQ: Admin path-traversal write via trace name

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The trace consumer constructs the output path as filename:join(TraceDir, Name ++ ".log") where Name comes from PUT /api/traces/:vhost/:name. No safe_relative_path / traversal check is applied on the write side, while the read side (rabbit_tracing_files.erl) does call rabbit_misc:safe_relative_path/1 , proving the omission is an oversight, not design. The .log suffix is forced and the endpoint requires administrator. A user with the administrator tag can write a .log-suffixed file to an arbitrary filesystem path writable by the rabbitmq user via the tracing plugin's name parameter, e.g. /etc/cron.d/x.log (if writable) or overwrite existing .log files outside the trace directory. Preconditions include rabbitmq_tracing plugin enabled administrator tag Target path writable by rabbitmq OS user. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.

References

https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-h7cq-qrr8-7... Vendor Advisory
https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6 Release Notes
https://ubuntu.com/security/CVE-2026-67224 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-67224 Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2026-67224 Vendor Advisory
https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1 Release Notes
https://nvd.nist.gov/vuln/detail/CVE-2026-67224 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67224... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

2.1 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-22Path Traversal

Timeline

Published23 Sep 2026

Updated19 Oct 2026

First seen23 Sep 2026

Sources

CVE-2026-67224 · NVD

CVE-2026-67224 · MITRE

UBUNTU-CVE-2026-67224 · OSV

DEBIAN-CVE-2026-67224 · OSV

CVE-2026-67224 · OSV

GHSA-h7cq-qrr8-7vgc · GHSA

BIT-rabbitmq-2026-67224 · OSV

Track software like this

Free during beta