All vulnerabilities
CVE-2026-66075GHSA-g5v3-w5xg-62q2

rabbitmq-server: RabbitMQ: Monitoring-tag user can restart federation links

rabbitmq rabbitmq-server
Open in ThreatlineRecord JSON
CVSS
2.3Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 12% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.13.15Also 4.0.20, 4.1.11 and 2 moreGitHub
Published23 Sep 2026Updated 24 Sep 2026CVE List

What fixes it

  • 3.13.15rabbitmq-server, otherGitHub
  • 4.0.20rabbitmq-server, otherGitHub
  • 4.1.11rabbitmq-server, otherGitHub
  • 4.2.6rabbitmq-server, otherGitHub
  • 4.3.1rabbitmq-server, otherGitHub

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, is_authorized/2 for the /federation-links/.../restart route uses is_authorized_monitor (accepts the monitoring tag), while allowed_methods permits DELETE and delete_resource/2 triggers rabbit_federation_link_sup:restart. There is no per-method elevation check and no comment marking it intentional. A read-only monitoring user can restart any federation link , a state-changing operation that disrupts message flow. Preconditions include rabbitmq_federation + rabbitmq_federation_management plugins enabled Attacker has credentials with the monitoring tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.

Text from CVE List

Affected versions 10

  • rabbitmq-serveraffected: >= 3.13.0, < 3.13.15CVE List
  • rabbitmq-serveraffected: >= 4.0.0, < 4.0.20CVE List
  • rabbitmq-serveraffected: >= 4.1.0, < 4.1.11CVE List
  • rabbitmq-serveraffected: >= 4.2.0, < 4.2.6CVE List
  • rabbitmq-serveraffected: >= 4.3.0, < 4.3.1CVE List
  • rabbitmq-server, other>= 3.13.0, < 3.13.15GitHub
  • rabbitmq-server, other>= 4.0.0, < 4.0.20GitHub
  • rabbitmq-server, other>= 4.1.0, < 4.1.11GitHub
  • rabbitmq-server, other>= 4.2.0, < 4.2.6GitHub
  • rabbitmq-server, other>= 4.3.0, < 4.3.1GitHub

References 3