CVE-2026-66069

Received Received - Intake

Authentication Attempt Counter Reset in RabbitMQ

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, is_authorized/2 uses is_authorized_monitor for all methods. DELETE resets rabbit_core_metrics:reset_auth_attempt_metrics(). Impact is cosmetic (counters only, no log erasure), but inconsistent with rabbit_mgmt_wm_reset.erl which requires admin for the analogous operation. A monitoring-tagged user can reset the per-node authentication-attempt counters via DELETE /api/auth/attempts/:node, erasing evidence of brute-force activity. The sibling endpoint wm_reset requires administrator. Preconditions include Management plugin enabled monitoring tag. This issue is fixed in versions 4.1.13, 4.2.7, and 4.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-23

Generated

2026-09-24

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-66069

EUVD

EUVD-2026-85632

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq	to 4.3.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

RabbitMQ is a messaging broker with a vulnerability in versions before 4.1.13, 4.2.7, and 4.3.0. The issue is in the is_authorized/2 function, which incorrectly allows monitoring-tagged users to reset authentication-attempt counters via DELETE /api/auth/attempts/:node. This erases evidence of brute-force attempts but only affects counters, not logs.

Detection Guidance

Check if the Management plugin is enabled and if any users have the monitoring tag. Inspect logs for DELETE requests to /api/auth/attempts/:node from non-admin users. Verify RabbitMQ versions are below 4.1.13, 4.2.7, or 4.3.0.

Impact Analysis

If you use RabbitMQ with the Management plugin enabled and monitoring-tagged users, an attacker could reset authentication-attempt counters. This hides evidence of brute-force attacks, making it harder to detect or investigate security incidents. The impact is cosmetic but could aid attackers in covering their tracks.

Mitigation Strategies

Upgrade RabbitMQ to versions 4.1.13, 4.2.7, or 4.3.0 or later. Remove the monitoring tag from non-admin users if present. Disable the Management plugin if not required.

Hi! I’m here to help you understand CVE-2026-66069. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70