CVE-2026-66069: RabbitMQ: Monitoring-tag DELETE of auth-attempt metrics
RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, isauthorized/2 uses isauthorizedmonitor for all methods. DELETE resets rabbitcoremetrics:resetauthattemptmetrics(). Impact is cosmetic (counters only, no log erasure), but inconsistent with rabbitmgmtwmreset.erl which requires admin for the analogous operation. A monitoring-tagged user can reset the per-node authentication-attempt counters via DELETE /api/auth/attempts/:node, erasing evidence of brute-force activity. The sibling endpoint wmreset requires administrator. Preconditions include Management plugin enabled monitoring tag. This issue is fixed in versions 4.1.13, 4.2.7, and 4.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.1.13 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.2.7 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.3.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with the monitoring tag can exploit it when the RabbitMQ Management plugin is enabled. Administrator privileges are not required for the affected DELETE endpoint.
What is the security impact of a successful exploit?
The attacker can reset per-node authentication-attempt counters through DELETE /api/auth/attempts/:node. This removes counter evidence of brute-force activity, but does not erase logs or affect authentication behavior.
Are default deployments affected?
The issue requires the Management plugin to be enabled and an attacker to have a monitoring-tagged account. Deployments without that plugin enabled, or without such user access, do not meet the stated preconditions.
What can be done before upgrading?
Restrict monitoring-tag access to trusted users, particularly where authentication-attempt counters are relied upon for detecting brute-force activity. Administrators can use the sibling reset endpoint, which requires administrator authorization, for legitimate reset operations.
How can I determine whether a RabbitMQ instance is fixed?
The issue is fixed in RabbitMQ versions 4.1.13, 4.2.7, and 4.3.0. Earlier versions in the affected release lines should be treated as vulnerable when the stated preconditions are present.