Information Exposure in RabbitMQ Messaging Broker
CVE-2026-66076

2.3LOW

Key Information:

Vendor

RabbitMQ

Status
RabbitMQ-server
Vendor
CVE Published:
23 September 2026

What is CVE-2026-66076?

RabbitMQ, a widely used messaging and streaming broker, has a vulnerability that allows unauthorized users to access sensitive information. Specifically, prior to certain versions, the is_authorized/2 function only checks the management tag without proper verification of user access to virtual hosts. This allows any user with management access to read critical Raft status information, including the cluster's topology, even if they do not have permission to access that virtual host. The vulnerability is particularly concerning as it exposes internal details that could facilitate further attacks. The issue has been addressed in updates 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. Ensure your RabbitMQ installation is updated to mitigate the risk.

Affected Version(s)

rabbitmq-server >= 3.13.0, < 3.13.15 < 3.13.0, 3.13.15

rabbitmq-server >= 4.0.0, < 4.0.20 < 4.0.0, 4.0.20

rabbitmq-server >= 4.1.0, < 4.1.11 < 4.1.0, 4.1.11

References

https://github.com/rabbitmq/rabbitmq-server/security/advi...
x_refsource_CONFIRM
https://github.com/rabbitmq/rabbitmq-server/releases/tag/...
x_refsource_MISC

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.