CVE-2026-66075: RabbitMQ: Monitoring-tag user can restart federation links
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, isauthorized/2 for the /federation-links/.../restart route uses isauthorizedmonitor (accepts the monitoring tag), while allowedmethods permits DELETE and deleteresource/2 triggers rabbitfederationlinksup:restart. There is no per-method elevation check and no comment marking it intentional. A read-only monitoring user can restart any federation link , a state-changing operation that disrupts message flow. Preconditions include rabbitmqfederation + rabbitmqfederationmanagement plugins enabled Attacker has credentials with the monitoring tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 3.13.15 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.0.20 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.1.11 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.2.6 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.3.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments are exposed when both the rabbitmq_federation and rabbitmq_federation_management plugins are enabled and RabbitMQ is running a version earlier than 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.1.
What access does an attacker need?
An attacker needs valid credentials for a user with the monitoring tag. That tag is intended for monitoring access, but it can authorize the restart route in affected versions.
What is the practical impact?
A monitoring-tag user can restart any federation link through the federation-links restart route. Restarting a link is state-changing and can disrupt message flow.
How can I mitigate the issue if I cannot patch immediately?
Disable either the rabbitmq_federation or rabbitmq_federation_management plugin where operationally feasible, or remove monitoring-tag credentials from untrusted users. The vulnerable restart route requires both plugins and monitoring-tag authentication.
How do I remediate it?
Upgrade to RabbitMQ 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.1, as appropriate for the release line in use.