All vulnerabilities
CVE-2026-67411GHSA-4r6f-9cpw-f6g6

rabbitmq-server: RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass

rabbitmq rabbitmq-server
Open in ThreatlineRecord JSON
CVSS
6.0Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 25 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 23% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published25 Sep 2026Updated 25 Sep 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3, native MQTT and MQTT over WebSocket behind a trusted PROXY Protocol frontend could lose the proxy-derived client address before the MQTT authentication path checked loopback_users, causing the frontend-to-broker address to be treated as loopback. An attacker who can reach the trusted frontend and has valid credentials for a loopback-restricted account can therefore bypass the source-address restriction; the issue does not bypass password authentication. This issue is fixed in versions 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3.

Text from CVE List

Affected versions 5

  • rabbitmq-serveraffected: >= 4.3.0, < 4.3.3CVE List
  • rabbitmq-serveraffected: >= 4.2.0, < 4.2.9CVE List
  • rabbitmq-serveraffected: >= 4.1.0, < 4.1.14CVE List
  • rabbitmq-serveraffected: >= 4.0.0, < 4.0.23CVE List
  • rabbitmq-serveraffected: >= 3.13.0, < 3.13.18CVE List

References 5