CVE-2026-66075— RabbitMQ: Monitoring-tag user can restart federation links
Quick assessment
Affected
rabbitmq rabbitmq-server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
RabbitMQ 是一个消息代理和流式处理中间件。在版本 3.13.15、4.0.20、4.1.11、4.2.6 和 4.3.1 之前，针对 路由的 函数使用了 （接受 monitoring 标签），而 允许执行 DELETE 操作， 则会触发 。该实现中不存在每方法级别的权限提升检查，也没有注释表明这是有意为之的设计。因此，拥有只读监控权限的用户可以重启任意联邦链接，这是一种会中断消息传递流程的状态变更操作。 漏洞利用前提条件包括： 启用了 和 插件； 攻击者拥有带有 monitoring 标签的凭据。 此问题已
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-66075
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
RabbitMQ: Monitoring-tag user can restart federation links
Source: CVE Program / CVE List V5
Vulnerability Description
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, is_authorized/2 for the /federation-links/.../restart route uses is_authorized_monitor (accepts the monitoring tag), while allowed_methods permits DELETE and delete_resource/2 triggers rabbit_federation_link_sup:restart. There is no per-method elevation check and no comment marking it intentional. A read-only monitoring user can restart any federation link , a state-changing operation that disrupts message flow. Preconditions include rabbitmq_federation + rabbitmq_federation_management plugins enabled Attacker has credentials with the monitoring tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| rabbitmq | rabbitmq-server | >= 3.13.0, < 3.13.15 | - |
|
II. Public POCs for CVE-2026-66075
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-66075
请登录查看更多情报信息。
Vendor Pages for CVE-2026-66075 (1)
Other References for CVE-2026-66075 (2)
-
Release RabbitMQ 4.3.1 · rabbitmq/rabbitmq-server · GitHub x_refsource_MISC
Same Patch Batch · rabbitmq · 2026-09-23 · 25 CVEs total
| CVE-2026-67404 | 9.2 CRITICAL | RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch |
| CVE-2026-67231 | 9.1 CRITICAL | RabbitMQ: Trust-store whitelist by Issuer+Serial only |
| CVE-2026-66079 | 8.2 HIGH | RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS |
| CVE-2026-67232 | 8.2 HIGH | RabbitMQ: Web-MQTT decompression bomb |
| CVE-2026-66070 | 7.6 HIGH | RabbitMQ: CORS * reflects Origin with Allow-Credentials |
| CVE-2026-66077 | 7.3 HIGH | RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI |
| CVE-2026-67235 | 7.1 HIGH | RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size |
| CVE-2026-67238 | 7.1 HIGH | RabbitMQ: Atom-table exhaustion via reply-to queue name decoding |
| CVE-2026-67229 | 6.9 MEDIUM | RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata |
| CVE-2026-67228 | 6.9 MEDIUM | RabbitMQ: Atom exhaustion: to_atom on runtime-parameter component |
| CVE-2026-67220 | 6.0 MEDIUM | RabbitMQ: JMS topic exchange erl_scan atom exhaustion |
| CVE-2026-66072 | 6.0 MEDIUM | RabbitMQ: Atom table exhaustion via stream `chunk_selector` |
| CVE-2026-66074 | 6.0 MEDIUM | RabbitMQ: ReDoS via management API ?name= filter |
| CVE-2026-67219 | 6.0 MEDIUM | RabbitMQ: Consistent-hash exchange unbounded weight |
| CVE-2026-66067 | 6.0 MEDIUM | RabbitMQ: Stream protocol skips per vhost per user connection limits |
| CVE-2026-66080 | 5.9 MEDIUM | RabbitMQ: Super-stream partitions unbounded allocation |
| CVE-2026-67221 | 5.9 MEDIUM | RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords |
| CVE-2026-66068 | 5.6 MEDIUM | RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs |
| CVE-2026-67405 | 5.3 MEDIUM | RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation) |
| CVE-2026-67240 | 2.3 LOW | RabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard |
Showing top 20 of 25 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: rabbitmq-server
-
CVE-2026-67420
RabbitMQ OAuth credential refresh retains revoked runtime ta -
CVE-2026-67419
RabbitMQ: Consecutive topic wildcards cause combinatorial ro -
CVE-2026-67421
RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth -
CVE-2026-67408
RabbitMQ: Stream Management Super-Stream Binding Keys Alloca -
CVE-2026-67406
RabbitMQ: Federation and Shovel Gen-Servers Lack format_stat
Same vendor: rabbitmq
-
CVE-2026-67420
RabbitMQ OAuth credential refresh retains revoked runtime ta -
CVE-2026-67419
RabbitMQ: Consecutive topic wildcards cause combinatorial ro -
CVE-2026-67421
RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth -
CVE-2026-67408
RabbitMQ: Stream Management Super-Stream Binding Keys Alloca -
CVE-2026-67406
RabbitMQ: Federation and Shovel Gen-Servers Lack format_stat
Same weakness: CWE-862
-
CVE-2026-96538
WarehousePG pg_file_write/pg_file_rename/pg_file_unlink/pg_l -
CVE-2026-86335
LXD Cross-Project Private Image Theft via Unsanitized GetIma -
CVE-2026-82377
Apache Roller: Missing weblog authorization in XML-RPC Blogg -
CVE-2026-101000
Netcore NBR100V2 ACL unauthenticated.json uci.apply authoriz -
CVE-2026-96283
Flatpak: flatpak: flatpak-system-helper cross-user cancelpul
V. Comments for CVE-2026-66075
No comments yet