Permission Check Bypass in RabbitMQ Messaging Broker
CVE-2026-67241
4.8MEDIUM
What is CVE-2026-67241?
In RabbitMQ versions 4.2.0 to 4.2.9 and 4.3.3, a permission check bypass vulnerability allows an attacker who has configure permissions on an exchange to send unroutable messages to an alternate exchange for which they lack write permission. This occurs because the AMQP 1.0 management API does not properly validate permissions when declaring alternate exchanges. The vulnerability presents a risk of unauthorized message routing, leading to potential data exposure. This issue is resolved in RabbitMQ versions 4.2.9 and 4.3.3, where proper permission checks have been implemented.
Affected Version(s)
rabbitmq-server >= 4.2.0, < 4.2.9 < 4.2.0, 4.2.9
rabbitmq-server >= 4.3.0, < 4.3.3 < 4.3.0, 4.3.3