CVE-2026-67411 rabbitmq CVE debrief

Who should care

Defenders responsible for RabbitMQ instances with loopback-restricted accounts and trusted PROXY Protocol frontends should assess exposure and apply patches. They should also review and update PROXY Protocol frontend configurations to ensure proper address derivation, restrict access to loopback-restricted accounts and verify credentials, and monitor RabbitMQ instances for unusual activity.

Why it matters

CVE-2026-67411 is a medium-severity vulnerability in RabbitMQ that allows an attacker with valid loopback-restricted account credentials to bypass source-address restrictions when accessing the server through a trusted PROXY Protocol frontend. Defenders should prioritize verifying exposure and applying patches, especially for RabbitMQ instances with loopback-restricted accounts and trusted PROXY Protocol frontends.

• Verify exposure of RabbitMQ instances to untrusted networks or users
• Assess the risk of unauthorized access to RabbitMQ instances with loopback-restricted accounts
• Prioritize patching for RabbitMQ instances with high-risk exposure
• Monitor for unusual activity or authentication attempts on RabbitMQ instances

Technical summary

RabbitMQ versions 3.13.0-3.13.18, 4.0.0-4.0.23, 4.1.0-4.1.14, 4.2.0-4.2.9, and 4.3.0-4.3.3 have a vulnerability that allows an attacker with valid loopback-restricted account credentials to bypass source-address restrictions when accessing the server through a trusted PROXY Protocol frontend. The vulnerability is caused by the loss of proxy-derived client address before the MQTT authentication path checked loopback_users, causing the frontend-to-broker address to be treated as loopback. This issue does not bypass password authentication.

Defensive priority

Defenders should prioritize verifying exposure and applying patches, especially for RabbitMQ instances with loopback-restricted accounts and trusted PROXY Protocol frontends.

Recommended defensive actions

• Verify RabbitMQ version and apply patches to versions 3.13.0-3.13.18, 4.0.0-4.0.23, 4.1.0-4.1.14, 4.2.0-4.2.9, or 4.3.0-4.3.3
• Review and update PROXY Protocol frontend configurations to ensure proper address derivation
• Restrict access to loopback-restricted accounts and verify credentials
• Monitor RabbitMQ instances for unusual activity
• Verify exposure of RabbitMQ instances to untrusted networks or users
• Assess the risk of unauthorized access to RabbitMQ instances with loopback-restricted accounts
• Prioritize patching for RabbitMQ instances with high-risk exposure

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed versions. However, additional information on exploitation or victim impact is not available. The vulnerability allows an attacker with valid loopback-restricted account credentials to bypass source-address restrictions when accessing the server through a trusted PROXY Protocol frontend. Defenders should verify exposure and apply patches, especially for RabbitMQ instances with loopback-restricted accounts and trusted PROXY Protocol frontends

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.