RabbitMQ CVE-2026-66076

Exploitation requires: (1) the RabbitMQ management plugin enabled; (2) an authenticated user account carrying the 'management' tag (PR:L); and (3) a multi-tenant deployment where quorum queues exist in vhosts the attacker is not authorized to access (the AT:P attack requirement) - in a single-tenant broker there is nothing cross-tenant to disclose. The attacker sends GET /api/queues/quorum/:vhost/:queue/status with a vhost/queue they should not see. Limiting factors: valid credentials with the management tag are mandatory, no privilege escalation or write access is gained, and impact is confined to read-only exposure of Raft status (leader, members, term, commit index), queue names, and cluster topology.

All signals converge on this being a low-priority, low-impact issue. The CVSS 4.0 base score is 2.3 with vector AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N - network-reachable but requiring an authenticated management-tagged account (PR:L), carrying an attack requirement (AT:P: exploitable state depends on quorum queues actually existing in vhosts the attacker cannot access, i.e. a real multi-tenant deployment), and yielding only low confidentiality impact (VC:L) with no integrity or availability effect. This is a CWE-862 missing-authorization (broken object-level access / IDOR) read primitive, not the 'Authentication Bypass' the input tag claims - the attacker is already authenticated; the flaw is a missing per-vhost authorization check (is_authorized/2 verifies only the management tag rather than calling is_authorized_vhost/2). EPSS, CISA KEV, and public POC are all absent from the input; therefore this is no public exploit identified at time of analysis, and there is no evidence of widespread or automated exploitation. Net: a genuine cross-tenant information-disclosure defect worth patching in multi-tenant brokers, but not an urgent, high-real-risk item. No conflicting signals of note - the vendor advisory (GHSA-j45q-v7g2-82ph) and fix releases are confirmed and consistent with the low score.

In a shared/multi-tenant RabbitMQ cluster with the management plugin enabled, a low-privilege user holding only the 'management' tag queries GET /api/queues/quorum/:vhost/:queue/status for a vhost belonging to another tenant. Because the handler validates only the management tag and not vhost access, it returns Raft status (leader, members, term, commit index), disclosing cross-tenant quorum-queue names and cluster topology. No public POC is referenced; exploitation requires an authenticated account and the presence of quorum queues in inaccessible vhosts.