SB20261104110 - Fedora 43 update for rabbitmq-server
Published: November 4, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 20 vulnerabilities.
1) Missing Authorization (CVE-ID: CVE-2026-67412)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose messages across virtual host boundaries and cause limited message loss.
The vulnerability exists due to missing authorization in federation upstream URI validation when processing an empty-host direct federation-upstream URI. A remote user can create a crafted federation-upstream configuration and attach a consumer to read and drain messages from another vhost to disclose messages across virtual host boundaries and cause limited message loss.
With the default ack-mode, messages are consumed from the source queue rather than copied. Exploitation requires control of a vhost where the user has policymaker permissions, and queue federation is triggered when a downstream consumer is attached.
2) Improper access control (CVE-ID: CVE-2026-67420)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to publish messages with a foreign AMQP user_id after that privilege should have been revoked.
The vulnerability exists due to improper access control in rabbit_access_control:update_state/2 and rabbit_access_control:check_user_id/2 when refreshing an existing AMQP connection from an OAuth token that no longer grants the impersonator tag. A remote user can refresh the connection with a same-username token that omits the impersonator tag to publish messages with a foreign AMQP user_id after that privilege should have been revoked.
Only connections that previously held the impersonator tag are affected. The issue requires a refresh-capable OAuth backend for AMQP, a successful credential refresh before the original credential-expiry timer closes the connection, and it affects both existing and newly opened channels on the refreshed connection.
3) Input validation error (CVE-ID: CVE-2026-67418)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper input validation in the MQTT 5 property parser and outbound PUBLISH property serializer when processing a crafted MQTT 5 PUBLISH packet containing an inapplicable property. A remote user can send a specially crafted PUBLISH message to cause a denial of service.
MQTT or Web MQTT must be enabled, and exploitation requires a separately authenticated MQTT 5 or Web MQTT subscriber on a matching topic or subscription filter.
4) Input validation error (CVE-ID: CVE-2026-67416)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service in consumer sessions or channels.
The vulnerability exists due to improper input validation in the optimized AMQP 1.0 server_mode parser and cross-protocol conversion paths when processing AMQP 1.0 messages with symbolic body descriptors that match a fixed textual prefix but use a different encoded symbol length. A remote user can publish a specially crafted AMQP 1.0 message to cause a denial of service in consumer sessions or channels.
Exploitation requires the ability to authenticate over AMQP 1.0, write to a target exchange or queue, and have the stored message consumed through a strict AMQP 1.0 decoder or a protocol path that forces full AMQP body decoding.
5) Unchecked Return Value (CVE-ID: CVE-2026-67409)
CWE-ID: CWE-252 - Unchecked Return Value
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to unchecked return value in the JWKS key fetching mechanism in uaa_jwt.erl when processing JWKS endpoint responses during signing key refresh. A remote attacker can send a crafted JWT with an unknown kid value to cause a denial of service.
Exploitation requires RabbitMQ to be configured with OAuth2 authentication using JWKS-based key discovery, and the JWKS endpoint must return an error response with a valid JSON body that lacks a keys field.
6) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-67225)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in rabbit_stream_core when processing inbound stream-protocol frames before authentication. A remote attacker can send a frame with a declared size exceeding the negotiated frame_max to cause a denial of service.
The stream plugin must be enabled.
7) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-67230)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the WebSocket path in the Web-STOMP handler when processing pre-authentication STOMP frames over WebSocket connections. A remote attacker can send a slow trickle of single-byte frames to cause a denial of service.
The rabbitmq_web_stomp plugin must be enabled.
8) Inefficient regular expression complexity (CVE-ID: CVE-2026-67413)
CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to inefficient regular expression complexity in the rabbitmq_jms_topic_exchange plugin when processing client-supplied JMS selectors during message routing. A remote user can bind an x-jms-topic exchange with an ambiguous LIKE pattern and repeatedly publish matching-shaped header values to cause a denial of service.
The issue affects the optional first-party JMS Topic Exchange plugin and delays publisher confirms while consuming broker CPU on the routing path.
9) Resource exhaustion (CVE-ID: CVE-2026-67222)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in auth_mechanism URI token processing in amqp_client when handling auth_mechanism query values. A remote privileged user can send a specially crafted request with a large number of colon-separated tokens to cause a denial of service.
Exploitation requires the Shovel or Federation plugin to be in use.
10) Resource exhaustion (CVE-ID: CVE-2026-66071)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in extract_scopes/1 in the OAuth2 authentication backend when processing user-influenced JWT scope values. A remote user can submit signed tokens with novel rabbitmq.tag: scope values to cause a denial of service.
Exploitation requires rabbitmq_auth_backend_oauth2 to be enabled and an IdP configuration that permits user-influenced scope values in signed tokens.
CWE-ID: CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information and perform unauthorized administrative actions.
The vulnerability exists due to improper output neutralization for html in RabbitMQ Management OAuth error handling when rendering an AMQP authorization-error reason in the OAuth management UI. A remote user can create a queue with a crafted html name and induce a management administrator to click Get Message(s) to disclose sensitive information and perform unauthorized administrative actions.
The issue is exploitable only when the OAuth management UI is enabled, the victim can see the queue but lacks AMQP read permission for it, automatic UI refresh remains active, and user interaction is required.
12) Incorrect authorization (CVE-ID: CVE-2026-67411)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass loopback-only user restrictions and authenticate to the MQTT service.
The vulnerability exists due to incorrect authorization in rabbit_web_mqtt_handler and rabbit_mqtt_processor when processing MQTT and MQTT over WebSocket connections behind a trusted PROXY Protocol frontend. A remote user can connect through the trusted frontend using valid credentials for a loopback-restricted account to bypass loopback-only user restrictions and authenticate to the MQTT service.
Exploitation requires `web_mqtt.proxy_protocol = true`, a reachable trusted frontend, and valid credentials for a loopback-restricted account.
13) Improper Encoding or Escaping of Output (CVE-ID: CVE-2026-67407)
CWE-ID: CWE-116 - Improper Encoding or Escaping of Output
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass MQTT topic authorization.
The vulnerability exists due to improper escaping of special elements in rabbit_auth_backend_internal.erl escape_regex_char/1 and topic permission expansion when processing MQTT topic permission templates that place {client_id} inside a character class. A remote user can supply a crafted client_id value to bypass MQTT topic authorization.
The issue affects read and write topic checks only when templates embed {client_id} within a [...] character class.
14) Improper Validation of Syntactic Correctness of Input (CVE-ID: CVE-2026-44838)
CWE-ID: CWE-1286 - Improper Validation of Syntactic Correctness of Input
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass topic authorization and access restricted topics.
The vulnerability exists due to improper neutralization of special elements in the MQTT topic permission authorization logic when substituting user-supplied client_id values into regular expression patterns. A remote user can supply a crafted client_id containing regex metacharacters to bypass topic authorization and access restricted topics.
This issue affects deployments that use variable substitution such as {client_id} in MQTT topic authorization patterns.
15) LDAP injection (CVE-ID: CVE-2026-67223)
CWE-ID: CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to modify integrity of LDAP-based authentication decisions.
The vulnerability exists due to improper neutralization of special elements used in an LDAP query in the fill/2 function of rabbit_auth_backend_ldap_util.erl when interpolating the username into a DN string for LDAP simple-bind. A remote attacker can supply a specially crafted username containing unescaped DN special characters to modify integrity of LDAP-based authentication decisions.
Only deployments with rabbitmq_auth_backend_ldap enabled and a user_dn_pattern containing ${username} are vulnerable. Exploitation also requires a directory layout where DN-suffix injection resolves to a useful entry.
16) Missing Authorization (CVE-ID: CVE-2026-61837)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to missing authorization in the AMQP 1.0 HTTP-over-AMQP management endpoint GET /bindings when handling management requests over an AMQP 1.0 management link pair. A remote user can send a specially crafted GET /bindings request to disclose sensitive information.
The issue exposes binding topology within the virtual host, including source and destination names, routing keys, binding arguments, and binding location URIs.
17) Resource exhaustion (CVE-ID: CVE-2026-67227)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the rabbitmq_management global parameter endpoint when handling repeated requests to /api/global-parameters/:name with unique name values. A remote privileged user can send repeated crafted requests with unique path values to cause a denial of service.
The management plugin must be enabled, and exploitation requires approximately one million HTTP requests.
18) Resource exhaustion (CVE-ID: CVE-2026-67226)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the PUT /api/users tags list handling in rabbit_auth_backend_internal.erl when processing a user-supplied tags list. A remote privileged user can send a specially crafted request with a large number of unique tag strings to cause a denial of service.
The issue can also be triggered when importing definitions.
19) Resource exhaustion (CVE-ID: CVE-2026-66073)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the management API node field handling in get_node/1 when processing crafted PUT requests to queue, exchange, or binding management endpoints. A remote user can send many requests with unique node values to cause a denial of service.
Exploitation requires a user account with the management tag and access to at least one vhost.
20) Cross-site scripting (CVE-ID: CVE-2026-67239)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary script code in the operator's browser.
The vulnerability exists due to cross-site scripting in the stream-connection detail page template when rendering TLS peer-certificate distinguished name fields. A remote attacker can present a certificate with a crafted distinguished name to execute arbitrary script code in the operator's browser.
User interaction is required because an operator must open the stream-connection detail page, and exploitation requires a stream TLS listener configured with peer verification and a trusted certificate containing an attacker-controlled distinguished name.
Remediation
Install update from vendor's website.