CVE-2026-67233
Received Received - Intake

Privilege Escalation in RabbitMQ Shovel Management

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The shovel management resource's is_authorized/2 delegates to rabbit_mgmt_util:is_authorized_monitor/2, which accepts the monitoring tag. But allowed_methods includes DELETE, and delete_resource/2 deletes / restarts shovel runtime parameters with no additional role check. A monitoring user , intended to have read-only visibility , can therefore delete or restart any shovel in any vhost they can see. A read-only monitoring user can delete or restart any dynamic shovel , a state-changing operation that the equivalent /api/parameters endpoint correctly restricts to policymaker. Preconditions include rabbitmq_shovel + rabbitmq_shovel_management plugins enabled Attacker has credentials with the monitoring tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-67233
EUVD
EUVD-2026-85951

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
rabbitmq rabbitmq to 3.13.15 (exc)
rabbitmq rabbitmq to 4.0.20 (exc)
rabbitmq rabbitmq to 4.1.11 (exc)
rabbitmq rabbitmq to 4.2.6 (exc)
rabbitmq rabbitmq to 4.3.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects RabbitMQ, a messaging broker. A monitoring user with read-only access can delete or restart any dynamic shovel due to improper authorization checks. The shovel management resource incorrectly allows DELETE operations for users with a monitoring tag, which should only permit read access.

Detection Guidance

Check RabbitMQ version with: rabbitmqctl status | grep -i version. If running vulnerable versions (3.13.0-3.13.14, 4.0.0-4.0.19, 4.1.0-4.1.10, 4.2.0-4.2.5, 4.3.0), update immediately. Review monitoring user permissions via: rabbitmqctl list_users. Look for users with 'monitoring' tag and verify they lack DELETE permissions on shovels.

Impact Analysis

If you use RabbitMQ with the shovel and shovel_management plugins enabled, an attacker with monitoring credentials could delete or restart shovels. This disrupts message routing, causes data loss, or leads to service outages. The impact depends on your RabbitMQ deployment and shovel configurations.

Compliance Impact

This vulnerability could impact compliance by enabling unauthorized changes to message routing, potentially violating data integrity or availability requirements in GDPR or HIPAA. Unauthorized deletions or restarts may lead to data loss or service disruptions, which are critical for compliance.

Mitigation Strategies

Upgrade RabbitMQ to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.1 or later to address the issue. Disable the rabbitmq_shovel and rabbitmq_shovel_management plugins if not required. Review user roles to ensure monitoring users do not have unnecessary permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67233. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart