CVE-2026-66075: RabbitMQ: Monitoring-tag user can restart federation links
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, isauthorized/2 for the /federation-links/.../restart route uses isauthorizedmonitor (accepts the monitoring tag), while allowedmethods permits DELETE and deleteresource/2 triggers rabbitfederationlinksup:restart. There is no per-method elevation check and no comment marking it intentional. A read-only monitoring user can restart any federation link , a state-changing operation that disrupts message flow. Preconditions include rabbitmqfederation + rabbitmqfederationmanagement plugins enabled Attacker has credentials with the monitoring tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.
Other sources
RabbitMQ: Monitoring-tag user can restart federation links
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.13.7-10 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 3.13.15 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.0.20 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.1.11 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.2.6 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.3.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments are exposed when both the rabbitmq_federation and rabbitmq_federation_management plugins are enabled and RabbitMQ is running a version earlier than 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.1.
What access does an attacker need?
An attacker needs valid credentials for a user with the monitoring tag. That tag is intended for monitoring access, but it can authorize the restart route in affected versions.
What is the practical impact?
A monitoring-tag user can restart any federation link through the federation-links restart route. Restarting a link is state-changing and can disrupt message flow.
How can I mitigate the issue if I cannot patch immediately?
Disable either the rabbitmq_federation or rabbitmq_federation_management plugin where operationally feasible, or remove monitoring-tag credentials from untrusted users. The vulnerable restart route requires both plugins and monitoring-tag authentication.
How do I remediate it?
Upgrade to RabbitMQ 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.1, as appropriate for the release line in use.