CVE-2026-66073 rabbitmq CVE debrief

Who should care

Defenders responsible for RabbitMQ instances, especially those with management API access, should assess exposure and apply patches or mitigations. Defenders should care about CVE-2026-66073 because it allows an attacker with low privileges to crash the RabbitMQ VM, affecting all tenants. The vulnerability exists in multiple versions of RabbitMQ and can be exploited via the management API. Defenders should verify exposure, apply patches, and monitor for

Why it matters

Defenders should care about CVE-2026-66073 because it allows an attacker with low privileges to crash the RabbitMQ VM, affecting all tenants. The vulnerability exists in multiple versions of RabbitMQ and can be exploited via the management API. Defenders should verify exposure, apply patches, and monitor for suspicious requests.

• Crash of RabbitMQ VM via system limit
• Loss of service for all tenants
• Potential for denial-of-service (DoS) attacks
• Need for verification of exposure and patch application

Technical summary

The RabbitMQ messaging and streaming broker is vulnerable to Atom table exhaustion via the management API node field. This issue exists in versions 3.13.0 through 3.13.15, 4.0.20, 4.1.11, and 4.2.6. An attacker with the management tag and one vhost can cause a crash by making roughly 900K requests, affecting all tenants and users with the lowest privilege. The vulnerability allows an attacker with low privileges to crash the RabbitMQ VM, affecting all tenants. Defenders should verify exposure, apply patches, and monitor for suspicious requests.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or mitigations, focusing on RabbitMQ instances with management API access.

Recommended defensive actions

• Verify RabbitMQ version and exposure to management API
• Apply patches or mitigations for affected versions
• Monitor for suspicious management API requests
• Restrict management API access to necessary users and vhosts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed versions. However, the corpus does not establish versions, exploitation, impact, or remediation beyond supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.