CVE-2026-66067

Received Received - Intake

RabbitMQ Stream Protocol Connection Limit Bypass

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The stream open handler calls only check_vhost_access; it omits the node/vhost/user connection-limit checks that rabbit_reader performs for AMQP. A developer %% FIXME comment at the cited line explicitly acknowledges the gap. No compensating enforcement exists in connection tracking or elsewhere in rabbitmq_stream. An authenticated tenant can fully bypass operator-configured per-user and per-vhost connection caps by connecting via port 5552 instead of 5672. Preconditions include rabbitmq_stream plugin enabled Authenticated stream-protocol credentials Operator relies on per-user/per-vhost connection limits for tenant isolation. This issue is fixed in versions 4.2.7 and 4.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-23

Generated

2026-09-24

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-66067

EUVD

EUVD-2026-85633

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq_stream	to 4.3.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability in RabbitMQ allows authenticated users to bypass configured connection limits by using the stream protocol port (5552) instead of the standard AMQP port (5672). The stream open handler lacks node/vhost/user connection-limit checks that are present in the AMQP handler, enabling tenants to exceed operator-set caps for isolation.

Detection Guidance

Check if the RabbitMQ stream plugin is enabled by running: rabbitmq-plugins list | grep stream. Verify if connections are made via port 5552 instead of 5672 using netstat -tulnp | grep 5552 or ss -tulnp | grep 5552.

Impact Analysis

If exploited, this flaw could allow unauthorized users to consume excessive server resources, degrade performance, or disrupt service availability. It undermines tenant isolation by letting users bypass connection limits, potentially leading to resource exhaustion or denial-of-service conditions.

Compliance Impact

This vulnerability could impact compliance by failing to enforce per-user/vhost connection limits, which are often required for data isolation and access control under GDPR and HIPAA. Failure to maintain these limits may result in violations of data protection and security requirements.

Mitigation Strategies

Upgrade RabbitMQ to versions 4.2.7 or 4.3.1 or later to address the issue. Disable the rabbitmq_stream plugin if not required using rabbitmq-plugins disable rabbitmq_stream.

Hi! I’m here to help you understand CVE-2026-66067. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70