CVE-2026-66076
Received
Received - Intake
Information Disclosure in RabbitMQ Management Plugin
Vulnerability report for CVE-2026-66076, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-09-23
Last updated on: 2026-09-23
Assigner: GitHub, Inc.
Description
Description
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, is_authorized/2 calls rabbit_mgmt_util:is_authorized/2, which checks only the management tag, instead of is_authorized_vhost/2. The /api/queues/quorum/:vhost/:queue/status handler reads the vhost from the path without checking that the user can access it. Any management-tagged user can therefore read Raft status, including leader, members, term, and commit index, for quorum queues in inaccessible vhosts, exposing cross-tenant queue names and cluster topology. The management plugin must be enabled and the attacker must have a management tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rabbitmq | rabbitmq | to 4.3.0 (exc) |
| rabbitmq | rabbitmq_server | From 3.13.0 (inc) to 3.13.15 (exc) |
| rabbitmq | rabbitmq_server | From 4.0.0 (inc) to 4.0.20 (exc) |
| rabbitmq | rabbitmq_server | From 4.1.0 (inc) to 4.1.11 (exc) |
| rabbitmq | rabbitmq_server | From 4.2.0 (inc) to 4.2.6 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
