CVE-2026-67412: RabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message access

Q: Which deployments are exposed?

RabbitMQ deployments running versions from 3.13.0 up to, but excluding, the fixed releases are affected: 3.13.18, 4.0.24, 4.1.14, 4.2.9, and 4.3.3 contain the fixes for their respective release lines.

Q: What access does an attacker need to exploit this issue?

The attacker needs to be able to act as a policymaker on one virtual host and configure a Federation upstream. The vulnerable authorization check allows that upstream to access a different virtual host even when the policymaker lacks permission there.

Q: What is the impact on messages in the unauthorized virtual host?

An attacker can read and drain messages from the other virtual host. Under the default acknowledgment mode, messages at the source are consumed and deleted rather than copied.

Q: How can the issue be remediated?

Upgrade to a fixed RabbitMQ release: 3.13.18, 4.0.24, 4.1.14, 4.2.9, or 4.3.3, as applicable to the deployed release line.

Published Sep 25, 2026

Updated

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9 , 4.1.14, 4.0.24, and 3.13.18, Federation upstream in RabbitMQ skips vhost authorization allowing cross-vhost message access. what the bug lets you do. A policymaker on one vhost reads and drains messages out of another vhost it has no permission on. With the default ack-mode the source messages are consumed (deleted), not copied. Why that should not 1. Federation validates the upstream URI without any vhost-access Cross-vhost message read/drain from a per-vhost policymaker, breaking vhost tenancy This issue is fixed in versions 4.3.3, 4.2.9 , 4.1.14, 4.0.24, and 3.13.18.

Affected Software

1 affected component

RabbitMQ RabbitMQ>=3.13.0<3.13.18, >=4.0.0<4.0.24, >=4.1.0<4.1.14, >=4.2.0<4.2.9, >=4.3.0<4.3.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade RabbitMQ to a version that resolves this vulnerability.
Fixed in 4.3.3
Upgrade
Upgrade RabbitMQ to a version that resolves this vulnerability.
Fixed in 4.2.9
Upgrade
Upgrade RabbitMQ to a version that resolves this vulnerability.
Fixed in 4.1.14
Upgrade
Upgrade RabbitMQ to a version that resolves this vulnerability.
Fixed in 4.0.24
Upgrade
Upgrade RabbitMQ to a version that resolves this vulnerability.
Fixed in 3.13.18

Event History

Sep 25, 2026

CVE Published

via MITRE·04:20 PM

Data Sourced

via MITRE·04:20 PM

DescriptionWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

RabbitMQ deployments running versions from 3.13.0 up to, but excluding, the fixed releases are affected: 3.13.18, 4.0.24, 4.1.14, 4.2.9, and 4.3.3 contain the fixes for their respective release lines.

What access does an attacker need to exploit this issue?