CVE-2026-67420

Undergoing Analysis Undergoing Analysis - In Progress

OAuth Token Privilege Escalation in RabbitMQ

Publication date: 2026-09-25

Last updated on: 2026-09-29

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains revoked runtime tags. when an existing AMQP connection refreshes from an OAuth token that grants the impersonator tag to a valid same-username token that no longer grants that tag, RabbitMQ updates the OAuth backend implementation (token/scopes/expiry) but leaves the connection's runtime #user.tags unchanged. rabbitaccesscontrol:checkuserid/2 then still honors the stale impersonator tag, so the connection (including newly opened channels) can continue publishing messages with a foreign AMQP userid after that privilege should have been revoked. A fresh connection using the downgraded token correctly refuses the same publish, proving the defect is stale session state rather than the token Limited to connections that once held impersonator and successfully refresh to a downgraded same-username rabbitauthbackendoauth2 (or an equivalent refresh-capable backend that returns tags) is enabled for This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-29

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-67420

EUVD

EUVD-2026-87244

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq	From 3.13.0 (inc) to 3.13.19 (inc)
rabbitmq	rabbitmq	4.0.24
rabbitmq	rabbitmq	4.1.15
rabbitmq	rabbitmq	4.2.10
rabbitmq	rabbitmq	4.3.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

RabbitMQ versions 3.13.0 to 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5 have a flaw where revoked OAuth credential tags are not properly updated in active connections. When a token refresh occurs, the connection retains stale impersonator privileges even if the new token no longer grants them. This allows unauthorized publishing under a foreign user ID after privileges should have been revoked.

Detection Guidance

This vulnerability involves stale OAuth tags in RabbitMQ connections. To detect it, monitor connections with impersonator tags that persist after token downgrades. Check RabbitMQ logs for token refresh events and compare runtime tags with current token scopes. Use RabbitMQ management plugin or CLI commands like 'rabbitmqctl list_connections' and 'rabbitmqctl list_users' to inspect active connections and user permissions.

Impact Analysis

This vulnerability allows an attacker to maintain unauthorized access to publish messages under a different user ID even after their privileges are revoked. It affects systems using OAuth authentication with RabbitMQ where tokens are refreshed. The impact is limited to connections that previously held impersonator tags and use refresh-capable OAuth backends.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized access to data through stale session privileges. If an OAuth token is downgraded to remove impersonator tags but the connection retains those privileges, it may enable unauthorized data access or actions, which conflicts with principles of least privilege and auditability required by these regulations.

Mitigation Strategies

Upgrade RabbitMQ to fixed versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, or 4.3.5 or later to address the OAuth credential refresh issue with revoked runtime tags.

Hi! I’m here to help you understand CVE-2026-67420. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70