CVE-2026-66067: RabbitMQ: Stream protocol skips per vhost per user connection limits
RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The stream open handler calls only checkvhostaccess; it omits the node/vhost/user connection-limit checks that rabbitreader performs for AMQP. A developer %% FIXME comment at the cited line explicitly acknowledges the gap. No compensating enforcement exists in connection tracking or elsewhere in rabbitmqstream. An authenticated tenant can fully bypass operator-configured per-user and per-vhost connection caps by connecting via port 5552 instead of 5672. Preconditions include rabbitmqstream plugin enabled Authenticated stream-protocol credentials Operator relies on per-user/per-vhost connection limits for tenant isolation. This issue is fixed in versions 4.2.7 and 4.3.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.2.7 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.3.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated tenant with stream-protocol credentials can exploit it when the rabbitmq_stream plugin is enabled. The impact is relevant where operators rely on per-user or per-vhost connection limits for tenant isolation.
What must an attacker do to bypass the configured limits?
The attacker connects using the Stream protocol on port 5552 rather than AMQP on port 5672. Stream connection handling checks vhost access but does not perform the node, vhost, and user connection-limit checks.
Are deployments protected if connection limits are configured?
No. Configured per-user and per-vhost connection caps can be fully bypassed through Stream protocol connections on affected versions when the stream plugin is enabled.
Which versions contain the fix?
The issue is fixed in RabbitMQ versions 4.2.7 and 4.3.1.