Messaging and Streaming Broker Vulnerability in RabbitMQ
CVE-2026-67418
What is CVE-2026-67418?
A vulnerability in the RabbitMQ messaging and streaming broker affects the MQTT 5 parser, allowing an authenticated publisher with topic write permission to send a Request-Problem-Information property within PUBLISH packets. This property is intended only for CONNECT packets and can lead to the broker incorrectly storing and routing it to a matching authenticated subscriber. When the subscriber attempts to serialize the outbound PUBLISH, an unhandled case generates a function_clause exception, resulting in disconnections of the victim's MQTT or Web MQTT connection. The broker and publisher connection remain operational, preventing message loss, but could potentially disrupt the subscriber's service.
Affected Version(s)
rabbitmq-server >= 3.13.0, < 3.13.19 < 3.13.0, 3.13.19
rabbitmq-server >= 4.0.0, < 4.0.24 < 4.0.0, 4.0.24
rabbitmq-server >= 4.1.0, < 4.1.15 < 4.1.0, 4.1.15