CVE-2026-66076

Undergoing Analysis Undergoing Analysis - In Progress

Information Disclosure in RabbitMQ Management Plugin

Publication date: 2026-09-23

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, is_authorized/2 calls rabbit_mgmt_util:is_authorized/2, which checks only the management tag, instead of is_authorized_vhost/2. The /api/queues/quorum/:vhost/:queue/status handler reads the vhost from the path without checking that the user can access it. Any management-tagged user can therefore read Raft status, including leader, members, term, and commit index, for quorum queues in inaccessible vhosts, exposing cross-tenant queue names and cluster topology. The management plugin must be enabled and the attacker must have a management tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-24

Generated

2026-10-14

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-12

NVD

CVE-2026-66076

EUVD

EUVD-2026-85623

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq	to 4.3.0 (exc)
rabbitmq	rabbitmq_server	From 3.13.0 (inc) to 3.13.15 (exc)
rabbitmq	rabbitmq_server	From 4.0.0 (inc) to 4.0.20 (exc)
rabbitmq	rabbitmq_server	From 4.1.0 (inc) to 4.1.11 (exc)
rabbitmq	rabbitmq_server	From 4.2.0 (inc) to 4.2.6 (exc)
rabbitmq	rabbitmq	From 3.13.0 (inc) to 3.13.15 (exc)
rabbitmq	rabbitmq	From 4.0.0 (inc) to 4.0.20 (exc)
rabbitmq	rabbitmq	From 4.1.0 (inc) to 4.1.11 (exc)
rabbitmq	rabbitmq	From 4.2.0 (inc) to 4.2.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in RabbitMQ's management plugin. It allows users with a management tag to access quorum queue status information for vhosts they are not authorized to access. The system only checks for the management tag but fails to validate vhost access permissions.

Detection Guidance

Check RabbitMQ management plugin logs for unauthorized access attempts to /api/queues/quorum/:vhost/:queue/status endpoints. Use commands like 'curl -u user:password http://localhost:15672/api/queues/quorum/vhost/queue/status' to test access. Monitor for users with management tags accessing unrelated vhosts.

Impact Analysis

An attacker with a management tag could read sensitive information about quorum queues in inaccessible vhosts. This includes queue names, cluster topology details like leader, members, term, and commit index. The impact is limited to information disclosure and requires the management plugin to be enabled.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing cross-tenant queue names and cluster topology details, including sensitive information about quorum queues. Unauthorized access to vhosts may lead to data exposure, violating confidentiality requirements in these regulations.

Mitigation Strategies

Upgrade RabbitMQ to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.0 or later. Disable the management plugin if not required. Restrict management tag access to authorized users only. Review and revoke unnecessary management permissions.

Hi! I’m here to help you understand CVE-2026-66076. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70