CVE-2026-66078

Analyzed Analyzed - Analysis Complete

Protected Tag Bypass in RabbitMQ via Bulk-Delete

Publication date: 2026-09-25

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, protected tag bypass via bulk-delete. dELETE /api/users/:name refuses to delete users tagged protected (rabbitmgmtwmuser:deleteresource/2 checks isprotecteduser). POST /api/users/bulk-delete iterates the supplied username list and calls rabbitauthbackendinternal:deleteuser/2 directly , that function has no protected-tag check , so the guard is silently An administrator can delete protected-tagged service accounts via the bulk endpoint, bypassing a safeguard the test suite confirms is rabbitmqmanagement enabled Attacker has the administrator tag A protected-tagged user. This issue is fixed in versions 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-66078

EUVD

EUVD-2026-87150

Affected Vendors & Products

Vendor	Product	Version / Range
broadcom	rabbitmq_server	From 3.13.0 (inc) to 3.13.15 (exc)
broadcom	rabbitmq_server	From 4.0.0 (inc) to 4.0.20 (exc)
broadcom	rabbitmq_server	From 4.1.0 (inc) to 4.1.11 (exc)
broadcom	rabbitmq_server	From 4.2.0 (inc) to 4.2.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in RabbitMQ allows an administrator with the correct tag to bypass a safeguard and delete protected-tagged users via the bulk-delete API endpoint. The DELETE endpoint checks for protected tags, but the bulk-delete endpoint does not, enabling unauthorized deletion of service accounts.

Detection Guidance

Check RabbitMQ management plugin logs for bulk-delete API calls targeting protected users. Look for POST /api/users/bulk-delete requests with administrator privileges. Verify if protected-tagged users are being deleted via this endpoint.

Impact Analysis

An attacker with administrator privileges could exploit this to delete protected service accounts, potentially disrupting services or causing data loss. The impact depends on the role of the deleted accounts in the RabbitMQ environment.

Compliance Impact

This vulnerability could lead to unauthorized deletion of user accounts, potentially violating data integrity and access control requirements in GDPR or HIPAA. Compliance may be impacted if protected accounts manage sensitive data.

Mitigation Strategies

Upgrade RabbitMQ to version 3.13.15 or later, 4.0.20 or later, 4.1.11 or later, or 4.2.6 or later. Disable the management plugin if not required. Review user permissions and remove unnecessary administrator privileges.

Hi! I’m here to help you understand CVE-2026-66078. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70