RabbitMQ EUVD-2026-87160

Exploitation requires a multi-tenant RabbitMQ broker (versions 3.13.0 up to the fixed releases) where the Federation plugin/feature is in use and the attacker already holds policymaker permission on at least one vhost (PR:L). The attacker abuses the Federation upstream definition: because the upstream URI is validated without any vhost-access authorization check, they can point it at a vhost on which they have no permissions. The default ack-mode further worsens impact by consuming (deleting) the source messages instead of copying them. Limiting factors: single-tenant deployments, brokers not using Federation, or environments that do not grant untrusted principals policymaker rights are not meaningfully exposed; no anonymous/unauthenticated access is possible.

This is a moderate-severity, authorization-boundary flaw rather than a mass-exploitable emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L, base 6.0) is internally consistent with CWE-862 (Missing Authorization): the attacker is network-adjacent but must already hold policymaker privileges on at least one vhost (PR:L), and a specific attack requirement (AT:P) applies - the deployment must be multi-tenant with Federation available and the attacker able to define an upstream. No EPSS score, CISA KEV entry, or public POC is present in the supplied data, so there is no evidence of active or automated exploitation; this reads as a targeted, insider/tenant-abuse risk rather than a broadly wormable one. One tension worth flagging: the vendor vector rates confidentiality only (VC:H, VI:N, VA:N), but the description states that with the default ack-mode source messages are consumed (deleted) rather than copied - that is a real availability/integrity loss for the victim vhost that the published vector arguably undercounts. Priority should be scaled to whether an environment actually runs multi-tenant vhosts with Federation; single-tenant or Federation-disabled brokers face little practical exposure.

In a multi-tenant RabbitMQ deployment, a user granted policymaker rights on their own vhost defines a Federation upstream whose URI points at a vhost they have no permissions on. Because Federation validates the upstream URI without a vhost-access check, the broker begins federating messages from the victim vhost, and under the default ack-mode those source messages are consumed (drained/deleted) rather than copied, exposing and destroying another tenant's data. No public exploit code is identified at time of analysis, but the attack requires only standard management/policy operations against a misconfigured multi-tenant broker.