OAuth Credential Refresh Flaw in RabbitMQ Messaging System
CVE-2026-67420
What is CVE-2026-67420?
RabbitMQ, a prominent messaging and streaming broker, has identified a vulnerability related to OAuth credential refresh mechanisms. This flaw occurs when the runtime tags, specifically the impersonator tag, are retained after the corresponding OAuth token has been revoked for a given AMQP connection. Even after the OAuth backend is updated to reflect the token's updated permissions, the connection continues to operate with outdated permissions, allowing unauthorized users to publish messages under different identifiers, thereby breaching intended access controls. The issue is present in several versions, but it has been addressed in the latest releases.
Affected Version(s)
rabbitmq-server >= 3.13.0, < 3.13.19 < 3.13.0, 3.13.19
rabbitmq-server >= 4.0.0, < 4.0.24 < 4.0.0, 4.0.24
rabbitmq-server >= 4.1.0, < 4.1.15 < 4.1.0, 4.1.15