Path Traversal Vulnerability in RabbitMQ Messaging and Streaming Broker
CVE-2026-67224
2.1LOW
What is CVE-2026-67224?
A path traversal vulnerability exists in the RabbitMQ messaging and streaming broker, allowing users with administrator privileges to write log files to arbitrary filesystem paths. This issue arises due to the lack of proper checks on the write side within the trace consumer logic, permitting potential overwrites of sensitive files if proper permissions are granted. The vulnerability is linked to the enabled rabbitmq_tracing plugin and can compromise system security if not addressed. Fixed versions include 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.
Affected Version(s)
rabbitmq-server >= 3.13.0, < 3.13.15 < 3.13.0, 3.13.15
rabbitmq-server >= 4.0.0, < 4.0.20 < 4.0.0, 4.0.20
rabbitmq-server >= 4.1.0, < 4.1.11 < 4.1.0, 4.1.11