CVE-2026-67233 rabbitmq CVE debrief

Who should care

RabbitMQ administrators and users with monitoring roles should assess exposure and verify user role restrictions to prevent unauthorized shovel management operations. They should also review compensating controls for exposed systems and monitor shovel management operations for unauthorized changes. This includes verifying RabbitMQ versions and applying updates if necessary.

Why it matters

CVE-2026-67233 allows monitoring users to delete or restart shovels in RabbitMQ, despite being intended for read-only access. Defenders should verify RabbitMQ versions, review user roles, and restrict monitoring users to prevent unauthorized operations.

• Monitoring users can delete or restart dynamic shovels, allowing for unintended state changes
• Read-only monitoring users can perform state-changing operations that should be restricted to policymaker roles
• RabbitMQ version verification is required to determine exposure
• User role review and restriction are necessary to prevent unauthorized shovel management operations

Technical summary

The RabbitMQ shovel management resource's authorization check incorrectly delegates to rabbit_mgmt_util:is_authorized_monitor/2, which accepts the monitoring tag. This allows monitoring users to delete or restart any shovel in any vhost they can see, despite being intended for read-only visibility. The issue is fixed in RabbitMQ versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1. Affected users should verify their RabbitMQ versions and review user roles to prevent unauthorized shovel management operations. The vulnerability allows monitoring users to perform state-changing operations that should be restricted to policymaker roles.

Defensive priority

Defenders should prioritize verifying RabbitMQ versions and user roles to prevent unauthorized shovel management operations.

Recommended defensive actions

• Verify RabbitMQ version and apply updates to 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.1
• Review user roles and restrict monitoring users to read-only access
• Monitor shovel management operations for unauthorized changes
• Confirm whether affected RabbitMQ deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the RabbitMQ shovel management resource authorization issue. The issue is fixed in RabbitMQ versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1. Evidence is based on official CVE Program and NVD sources. The shovel management resource's authorization check incorrectly delegates to rabbit_mgmt_util:is_authorized_monitor/2, which accepts the monitoring tag. This allows monitoring users to delete or restart any shovel in any vhost they can see, despite being intended for read-only visibility

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.