CVE-2026-67224

Received Received - Intake

Path Traversal in RabbitMQ via Tracing Plugin

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The trace consumer constructs the output path as filename:join(TraceDir, Name ++ ".log") where Name comes from PUT /api/traces/:vhost/:name. No safe_relative_path / traversal check is applied on the write side, while the read side (rabbit_tracing_files.erl) does call rabbit_misc:safe_relative_path/1 , proving the omission is an oversight, not design. The .log suffix is forced and the endpoint requires administrator. A user with the administrator tag can write a .log-suffixed file to an arbitrary filesystem path writable by the rabbitmq user via the tracing plugin's name parameter, e.g. /etc/cron.d/x.log (if writable) or overwrite existing .log files outside the trace directory. Preconditions include rabbitmq_tracing plugin enabled administrator tag Target path writable by rabbitmq OS user. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-23

Generated

2026-09-24

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-67224

EUVD

EUVD-2026-85629

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq	to 3.13.15\|end_excluding=4.0.20\|end_excluding=4.1.11\|end_excluding=4.2.6\|end_excluding=4.3.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability in RabbitMQ allows an administrator to write a .log file to an arbitrary filesystem path via the tracing plugin's name parameter. The system fails to validate the path for directory traversal, enabling file writes outside the intended trace directory.

Detection Guidance

Check if the RabbitMQ tracing plugin is enabled by running: rabbitmq-plugins list | grep tracing. Verify if the rabbitmq user has write permissions to sensitive directories like /etc/cron.d or /etc/. Look for unexpected .log files in system directories.

Impact Analysis

An attacker with administrator privileges could overwrite critical system files like /etc/cron.d/x.log or create malicious cron jobs, leading to remote code execution. This could compromise the entire system.

Compliance Impact

This vulnerability could lead to unauthorized file modifications, potentially violating data integrity and confidentiality requirements in GDPR and HIPAA. It may result in non-compliance due to insufficient access controls.

Mitigation Strategies

Upgrade RabbitMQ to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.1 or later. Disable the tracing plugin if not needed with: rabbitmq-plugins disable rabbitmq_tracing. Restrict write permissions for the rabbitmq user to sensitive directories.

Hi! I’m here to help you understand CVE-2026-67224. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70