CVE-2026-67420 rabbitmq CVE debrief

Who should care

Defenders responsible for RabbitMQ deployments, particularly those using OAuth for authentication, should assess exposure and prioritize updates to affected versions. They should review existing connections, monitor for unusual activity, and verify RabbitMQ versions to ensure they are not vulnerable.

Why it matters

CVE-2026-67420 allows a connection to publish messages with a foreign AMQP userid after privileges should have been revoked. Defenders should prioritize verifying and updating RabbitMQ versions, reviewing existing connections, and monitoring for unusual activity.

• Potential unauthorized message publishing with foreign AMQP userid
• Stale session state allowing impersonation
• Need for verification of existing connections
• Priority for updating RabbitMQ versions

Technical summary

RabbitMQ OAuth credential refresh retains revoked runtime tags. When an existing AMQP connection refreshes from an OAuth token that grants the impersonator tag to a valid same-username token that no longer grants that tag, RabbitMQ updates the OAuth backend implementation but leaves the connection's runtime #user.tags unchanged. This allows the connection, including newly opened channels, to continue publishing messages with a foreign AMQP userid after that privilege should have been revoked. The issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.

Defensive priority

Defenders should prioritize verifying and updating RabbitMQ versions to 3.13.19, 4.0.24, 4.1.15, 4.2.10, or 4.3.5, and review existing connections for potential exposure.

Recommended defensive actions

• Verify and update RabbitMQ to version 3.13.19, 4.0.24, 4.1.15, 4.2.10, or 4.3.5
• Review existing connections for potential exposure
• Monitor for unusual publishing activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• technicalSummary

Evidence notes

The issue is limited to connections that once held impersonator and successfully refresh to a downgraded same-username rabbitauthbackendoauth2. Evidence is based on official RabbitMQ and NVD sources. The vulnerability allows a connection to publish messages with a foreign AMQP userid after privileges should have been revoked. Defenders should verify existing connections and monitor for unusual activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.