CVE-2026-67412 rabbitmq CVE debrief

Who should care

RabbitMQ administrators and users with policymaker access to vhosts should assess exposure and prioritize patching. Defenders should prioritize patching RabbitMQ instances to prevent unauthorized message access. Users with policymaker access to vhosts should review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-67412 allows for cross-vhost message access in RabbitMQ, potentially leading to unauthorized message access and deletion. Defenders should prioritize patching RabbitMQ instances to prevent this vulnerability.

• Potential unauthorized message access
• Message deletion with default ack-mode
• Cross-vhost message read/drain by policymaker

Technical summary

The vulnerability allows a policymaker on one vhost to read and drain messages from another vhost they have no permission on. This issue is fixed in versions 4.3.3, 4.2.9, 4.1.14, 4.0.24, and 3.13.18. The vulnerability allows unauthorized message access and deletion with default ack-mode. Defenders should prioritize patching RabbitMQ instances to prevent unauthorized message access. The issue allows a policymaker on one vhost to read and drain messages from another vhost they have no permission on. This can lead to potential unauthorized message access and message deletion with default ack-mode.

Defensive priority

Defenders should prioritize patching RabbitMQ instances to prevent unauthorized message access.

Recommended defensive actions

• Patch RabbitMQ instances to versions 4.3.3, 4.2.9, 4.1.14, 4.0.24, or 3.13.18
• Restrict policymaker access to vhosts
• Monitor for unauthorized message access
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability allows a policymaker on one vhost to read and drain messages from another vhost they have no permission on. This issue is fixed in versions 4.3.3, 4.2.9, 4.1.14, 4.0.24, and 3.13.18.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.