CVE-2026-67418 rabbitmq CVE debrief

Who should care

RabbitMQ administrators and users with topic write permissions should verify their versions and restrict permissions to mitigate potential impact. They should also review and restrict topic write permissions for authenticated publishers and monitor for potential connection closures. Additionally, defenders should prioritize verifying and upgrading to fixed versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, or 4.3.5.

Why it matters

CVE-2026-67418 is a medium-severity vulnerability in RabbitMQ MQTT 5 that can cause subscriber connections to close when an authenticated publisher sends an inapplicable PUBLISH property. Defenders should verify and upgrade to fixed versions, restrict topic write permissions, and monitor for potential connection closures.

• Potential MQTT connection closures for subscribers.
• Verification of RabbitMQ version and configuration is required.
• Restrict topic write permissions for authenticated publishers.

Technical summary

The MQTT 5 parser in RabbitMQ accepts Request-Problem-Information on PUBLISH packets even though the property is valid only for CONNECT. An authenticated publisher with topic write permission can cause the broker to store and route that inapplicable property to a separately authenticated matching subscriber. When the subscriber path serializes the outbound PUBLISH, serialise_prop/2 has no matching clause, and the uncontained function_clause exception closes the victim MQTT or Web MQTT connection.

Defensive priority

Defenders should prioritize verifying and upgrading to fixed versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, or 4.3.5.

Recommended defensive actions

• Verify and upgrade to fixed RabbitMQ versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, or 4.3.5.
• Review and restrict topic write permissions for authenticated publishers.
• Monitor for and handle potential MQTT connection closures.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The issue is caused by the MQTT 5 parser in deps/rabbitmq_mqtt/src/rabbit_mqtt_packet.erl accepting Request-Problem-Information on PUBLISH packets even though the property is valid only for CONNECT. The source code review indicates that the MQTT 5 parser does not properly validate the PUBLISH packet properties, leading to the vulnerability. The issue is further complicated by the fact that the broker stores and routes the inapplicable property to matching subscribers, which can cause their connections to close. Defenders should verify

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.