RabbitMQ CVE-2026-67226

Requires RabbitMQ administrator privileges: the attacker must be able to call the management HTTP API endpoint PUT /api/users (or import a definitions file), both of which are restricted to users with the administrator tag. Exploitation sends a tags list containing roughly one million unique strings within the 20 MB management-API body limit; each string is coerced to a permanent Erlang atom, exhausting the bounded atom table and crashing the BEAM node. Limiting factors: the management plugin/HTTP API must be enabled and reachable, and the operation demands high administrative privilege - there is no unauthenticated or low-privilege path. Affected versions are 4.0.0 through before 4.0.22, and the 4.1.x/4.2.x lines before 4.1.14 and 4.2.7 respectively.

This is a genuine but low-priority denial-of-service issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H, score 6.9) is internally consistent with the description: pure availability impact (VA:H, no confidentiality/integrity) requiring high privileges (PR:H). The critical limiting signal is PR:H - the description explicitly states 'An administrator can crash the node,' and the fix diff confirms the vector is user-management operations (PUT /api/users, definitions import) that are admin-gated. This substantially lowers real-world priority: an actor who already holds RabbitMQ administrator rights can disrupt the broker through many other means, so this bug adds little to their capability. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, indicating no evidence of active or imminent exploitation. Exploitation status: no public exploit identified at time of analysis. The signals do not conflict; they converge on a real-but-low-urgency, high-CVSS-but-low-practical-risk classification driven entirely by the administrator prerequisite.

An authenticated RabbitMQ administrator (or an attacker who has compromised admin credentials) sends a single PUT /api/users request - or imports a definitions file - creating a user whose tags list contains ~1 million unique short strings, fitting within the 20 MB management-API body limit. Each unique tag is coerced to an Erlang atom via rabbit_data_coercion:to_atom/1; because atoms are never garbage-collected and the atom table is bounded, the node exhausts its atom table and crashes, disrupting messaging for all tenants. No public exploit code is identified at time of analysis.