Skip to main content

RabbitMQ CVE-2026-67411

| EUVDEUVD-2026-87229 MEDIUM
Incorrect Authorization (CWE-863)
2026-09-25 GitHub_M
Rabbitmq Server Mqtt Erlang Rabbitmq
6.0
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
6.0 MEDIUM
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

Network-reachable but AC:H for the PROXY-frontend + loopback_users precondition, PR:L because valid credentials are required; impact is gaining restricted-account access (C:H) with no direct integrity/availability effect.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

6
Patch available
Sep 25, 2026 - 18:19 EUVD
Metadata Corrected
Sep 25, 2026 - 17:40 vuln.today
tag: Mqtt added
Metadata Corrected
Sep 25, 2026 - 17:40 vuln.today
tag: Erlang added
Metadata Corrected
Sep 25, 2026 - 17:40 vuln.today
tag: Authentication Bypass removed
Analysis Generated
Sep 25, 2026 - 17:19 vuln.today
CVE Published
Sep 25, 2026 - 16:26 cve.org
MEDIUM 6.0

DescriptionCVE.org

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3, native MQTT and MQTT over WebSocket behind a trusted PROXY Protocol frontend could lose the proxy-derived client address before the MQTT authentication path checked loopback_users, causing the frontend-to-broker address to be treated as loopback. An attacker who can reach the trusted frontend and has valid credentials for a loopback-restricted account can therefore bypass the source-address restriction; the issue does not bypass password authentication. This issue is fixed in versions 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3.

AnalysisAI

Loopback source-address restriction bypass in RabbitMQ's native MQTT and MQTT-over-WebSocket listeners (all releases from 3.13.0 up to the fixed versions 3.13.18, 4.0.23, 4.1.14, 4.2.9 and 4.3.3) allows an authenticated attacker holding valid credentials for a loopback-restricted account to reach that account from a non-loopback address. The flaw only manifests when such a listener runs behind a trusted frontend that speaks PROXY Protocol: the proxy-derived client address is dropped before the MQTT authentication path evaluates the loopback_users setting, so the frontend-to-broker connection is mistakenly judged as loopback. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires ALL of: (1) RabbitMQ 3.13.0 through the fixed releases running native MQTT or MQTT over WebSocket; (2) that listener deployed behind a trusted frontend that speaks PROXY Protocol; (3) at least one account restricted to loopback via the loopback_users setting; and (4) the attacker holding valid credentials for that loopback-restricted account plus network reach to the trusted frontend. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment CVSS 4.0 base 6.0 (AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N) describes a network-reachable but conditions-heavy authorization flaw: exploitation carries both high attack complexity (AC:H) and a present attack requirement (AT:P), reflecting the need for a specific deployment (native MQTT or MQTT-over-WebSocket sitting behind a trusted PROXY Protocol frontend) and for the broker to actually restrict an account to loopback. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Vendor-released patch: upgrade to RabbitMQ 3.13.18, 4.0.23, 4.1.14, 4.2.9 or 4.3.3 depending on your maintained branch, as documented in GHSA-4r6f-9cpw-f6g6 (https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-4r6f-9cpw-f6g6); the code fixes are in commits a7528314840c4f8dc9904684f9f97ffa7aac6349 and edbead0eabbd65925d0dc914a22d6a29e155e646, so a manual backport is feasible only if you can carry both the reader/processor change and the Web MQTT handler change together - a partial backport leaves one listener path exposed. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Rabbitmq Server

View all
CVE-2026-57219 HIGH POC
8.7 Jul 10

Sensitive credential disclosure in RabbitMQ affects installations running the management plugin with OAuth 2 configured

CVE-2019-11287 HIGH POC
7.5 Nov 23

Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x ver
CVE-2016-9877 CRITICAL
9.8 Dec 29

An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.
CVE-2025-50200 MEDIUM POC
5.5 Jun 19

RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in
CVE-2026-67404 CRITICAL
9.2 Sep 23

RabbitMQ brokers that use the OAuth2 plugin can silently fall back to disabled TLS certificate verification when no CA b
CVE-2026-67231 CRITICAL
9.1 Sep 23

TLS client-authentication bypass in the RabbitMQ trust-store plugin lets a remote unauthenticated attacker whose forged

CVE-2026-67409 HIGH
8.2 Sep 25

Authentication denial of service in RabbitMQ affects deployments running the rabbitmq_auth_backend_oauth2 plugin from 3.
CVE-2026-67410 HIGH
8.2 Sep 25

OAuth2 client secret disclosure in the RabbitMQ Management UI affects versions 4.2.0 through 4.2.8 and 4.3.0 through 4.3
CVE-2026-67232 HIGH
8.2 Sep 23

Memory-exhaustion denial of service in RabbitMQ's Web-MQTT plugin (rabbitmq_web_mqtt) lets an unauthenticated remote att
CVE-2026-67236 HIGH
8.2 Sep 25

The RabbitMQ management plugin in versions 4.2.0 through 4.2.8 and 4.3.0 through 4.3.2 writes an 'auth' cookie containin
CVE-2017-4966 HIGH
7.8 Jun 13

An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions p
CVE-2021-22117 HIGH
7.8 May 18

RabbitMQ installers on Windows prior to version 3.8.16 do not harden plugin directory permissions, potentially allowing

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2026-71362 CRITICAL POC
9.1
CVE-2026-42016 HIGH POC
8.8
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected

Share

CVE-2026-67411 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy