CVE-2026-66067
- Source
- https://cve.org/CVERecord?id=CVE-2026-66067
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-66067.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-66067
- Aliases
-
- BIT-rabbitmq-2026-66067
- GHSA-hwqx-2gfg-89qf
- Downstream
- Published
- 2026-09-23T20:12:00Z
- Modified
- 2026-10-22T10:36:06Z
- Severity
-
- 6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- RabbitMQ: Stream protocol skips per vhost per user connection limits
- Details
-
RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The stream open handler calls only check_vhost_access; it omits the node/vhost/user connection-limit checks that rabbit_reader performs for AMQP. A developer %% FIXME comment at the cited line explicitly acknowledges the gap. No compensating enforcement exists in connection tracking or elsewhere in rabbitmq_stream. An authenticated tenant can fully bypass operator-configured per-user and per-vhost connection caps by connecting via port 5552 instead of 5672. Preconditions include rabbitmq_stream plugin enabled Authenticated stream-protocol credentials Operator relies on per-user/per-vhost connection limits for tenant isolation. This issue is fixed in versions 4.2.7 and 4.3.1.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-770" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66067.json" }- References
-
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66067.json
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-hwqx-2gfg-89qf
- https://nvd.nist.gov/vuln/detail/CVE-2026-66067
Affected packages
Git / github.com/rabbitmq/rabbitmq-server
Affected ranges
- Type
- GIT
- Repo
- https://github.com/rabbitmq/rabbitmq-server
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "4.2.0" }, { "fixed": "4.2.7" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "4.3.0" }, { "fixed": "4.3.1" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "original_tag": "v4.2.7", "range": [ { "fixed": "b15fd2a3e5465cb6ed403d5a774ef61b1a391b89" } ], "source": "REFERENCES_TAG" }, { "original_tag": "v4.3.1", "range": [ { "fixed": "49decca35e59d2cb774e5abd76412cee721308a5" } ], "source": "REFERENCES_TAG" } ] }