{"schema":"threatline.record/2","record":{"id":"CVE-2026-66067","aliases":["GHSA-hwqx-2gfg-89qf"],"summary":"RabbitMQ: Stream protocol skips per vhost per user connection limits","details":"RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The stream open handler calls only check_vhost_access; it omits the node/vhost/user connection-limit checks that rabbit_reader performs for AMQP. A developer %% FIXME comment at the cited line explicitly acknowledges the gap. No compensating enforcement exists in connection tracking or elsewhere in rabbitmq_stream. An authenticated tenant can fully bypass operator-configured per-user and per-vhost connection caps by connecting via port 5552 instead of 5672. Preconditions include rabbitmq_stream plugin enabled Authenticated stream-protocol credentials Operator relies on per-user/per-vhost connection limits for tenant isolation. This issue is fixed in versions 4.2.7 and 4.3.1.","categories":["Unclassified"],"product":"rabbitmq-server","vendor":"rabbitmq","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-66067","source_modified_at":"2026-09-24T14:11:44.566Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"rabbitmq-server","vendor":"rabbitmq","versions":[{"version":">= 4.2.0, < 4.2.7","status":"affected"},{"version":">= 4.3.0, < 4.3.1","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":6,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00351,"percentile":0.27538,"score_date":"2026-10-23"},"published_at":"2026-09-23T20:12:00.076Z","modified_at":"2026-09-24T14:11:44.566Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-66067","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-24T14:11:44.566Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-66067","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-hwqx-2gfg-89qf","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-09-24T14:11:25.836720Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-24T14:11:44.566Z","content_hash":"3069efb29085957d7fe8bef434177d3b339a73146ccfcdfbfc6c68736ee8c35d"}}