CVE-2026-67224: RabbitMQ: Admin path-traversal write via trace name
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The trace consumer constructs the output path as filename:join(TraceDir, Name ++ ".log") where Name comes from PUT /api/traces/:vhost/:name. No saferelativepath / traversal check is applied on the write side, while the read side (rabbittracingfiles.erl) does call rabbitmisc:saferelativepath/1 , proving the omission is an oversight, not design. The .log suffix is forced and the endpoint requires administrator. A user with the administrator tag can write a .log-suffixed file to an arbitrary filesystem path writable by the rabbitmq user via the tracing plugin's name parameter, e.g. /etc/cron.d/x.log (if writable) or overwrite existing .log files outside the trace directory. Preconditions include rabbitmqtracing plugin enabled administrator tag Target path writable by rabbitmq OS user. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 3.13.15
Event History
Frequently Asked Questions
Who is exposed to this issue?
Affected deployments are those running a version earlier than 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.1 with the rabbitmq_tracing plugin enabled. Exploitation also depends on an attacker having a RabbitMQ user account with the administrator tag.
What access and conditions are required for exploitation?
The attacker must be able to invoke PUT /api/traces/:vhost/:name as an administrator and supply a traversal path in the trace name. The destination filesystem path must be writable by the operating-system user running RabbitMQ, and the written filename will have a .log suffix.
Are default RabbitMQ installations affected?
The vulnerable code is only reachable when the rabbitmq_tracing plugin is enabled. The provided information does not establish whether that plugin is enabled by default.
What can be done before upgrading?
Disable the rabbitmq_tracing plugin if it is not needed, and restrict administrator-tag assignments to trusted users. Ensure the RabbitMQ operating-system user cannot write to sensitive locations outside the intended trace directory.
How can I assess potential impact or prior abuse?
Review trace names submitted through the trace API for path-traversal sequences and inspect for unexpected .log files or modified existing .log files outside the configured trace directory. Focus on locations writable by the RabbitMQ operating-system user.