CVE-2026-67411

Analyzed Analyzed - Analysis Complete

MQTT Loopback Bypass in RabbitMQ

Publication date: 2026-09-25

Last updated on: 2026-10-08

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3, native MQTT and MQTT over WebSocket behind a trusted PROXY Protocol frontend could lose the proxy-derived client address before the MQTT authentication path checked loopback_users, causing the frontend-to-broker address to be treated as loopback. An attacker who can reach the trusted frontend and has valid credentials for a loopback-restricted account can therefore bypass the source-address restriction; the issue does not bypass password authentication. This issue is fixed in versions 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-08

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-67411

EUVD

EUVD-2026-87229

Affected Vendors & Products

Vendor	Product	Version / Range
broadcom	rabbitmq_server	From 4.1.0 (inc) to 4.1.14 (exc)
broadcom	rabbitmq_server	From 4.2.0 (inc) to 4.2.9 (exc)
broadcom	rabbitmq_server	From 4.3.0 (inc) to 4.3.3 (exc)
broadcom	rabbitmq_server	From 4.0.0 (inc) to 4.0.23 (exc)
broadcom	rabbitmq_server	From 3.13.0 (inc) to 3.13.18 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

RabbitMQ versions 3.13.0 to 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3 have a flaw in MQTT and MQTT over WebSocket handling when behind a trusted PROXY Protocol frontend. The vulnerability causes the broker to incorrectly treat the frontend-to-broker address as a loopback address during authentication checks. This allows an attacker with valid credentials for a loopback-restricted account to bypass source-address restrictions, but does not bypass password authentication.

Detection Guidance

Detecting this vulnerability requires checking RabbitMQ versions and configuration. Verify if your RabbitMQ version is between 3.13.0-3.13.17, 4.0.0-4.0.22, 4.1.0-4.1.13, 4.2.0-4.2.8, or 4.3.0-4.3.2. Use commands like 'rabbitmqctl status' or 'rabbitmq-diagnostics status' to check the version. If using PROXY Protocol, inspect configuration files for 'proxy_protocol' settings and 'loopback_users' restrictions.

Impact Analysis

An attacker who can reach the trusted frontend and has valid credentials for a loopback-restricted account could exploit this to bypass network-based access controls. This could lead to unauthorized access to sensitive data or broker functions, but only if the attacker already has valid credentials and the account is restricted to loopback addresses.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access to restricted accounts through a bypass of source-address restrictions. If exploited, it may lead to unauthorized data access or disclosure, violating confidentiality requirements under these regulations.

Mitigation Strategies

Upgrade RabbitMQ to a patched version (3.13.18, 4.0.23, 4.1.14, 4.2.9, or 4.3.3 or later) to address the proxy-derived client address bypass in MQTT authentication.

Hi! I’m here to help you understand CVE-2026-67411. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70