Messaging and Streaming Broker Vulnerability Affecting RabbitMQ
CVE-2026-66067
What is CVE-2026-66067?
In RabbitMQ, prior to versions 4.2.7 and 4.3.1, a vulnerability was identified within the stream open handler, which was insufficient in enforcing connection limits managed by the operator. This flaw allows an authenticated user to exploit the messaging system by bypassing configured connection restrictions when utilizing the stream protocol. It occurs due to the omission of necessary checks for connection limits that should be performed alongside the check for virtual host access. This gap in security can lead to unauthorized access and connection overflow, undermining tenant isolation. Users are advised to update to versions 4.2.7 or 4.3.1 to mitigate this issue.
Affected Version(s)
rabbitmq-server >= 4.2.0, < 4.2.7 < 4.2.0, 4.2.7
rabbitmq-server >= 4.3.0, < 4.3.1 < 4.3.0, 4.3.1