Privilege Escalation in RabbitMQ Messaging Broker
CVE-2026-67218
What is CVE-2026-67218?
A vulnerability in RabbitMQ prior to versions 4.0.22, 4.1.11, 4.2.6, and 4.3.0 allows a user with management tag and vhost access, but lacking configure permissions, to create super-streams via the HTTP API. The issue arises because the HTTP handler does not enforce necessary permissions, creating a pathway for unauthorized resource creation on the system. This compromise can lead to the elevation of privileges by transforming a user from merely having view access to the ability to institute persistent cluster-wide resources without proper authorization. The flaw is addressed in the mentioned versions, emphasizing the importance of maintaining updated system installations.
Affected Version(s)
rabbitmq-server >= 4.0.0, < 4.0.22 < 4.0.0, 4.0.22
rabbitmq-server >= 4.1.0, < 4.1.11 < 4.1.0, 4.1.11
rabbitmq-server >= 4.2.0, < 4.2.6 < 4.2.0, 4.2.6