CVE-2026-67420
RabbitMQ is a messaging and streaming broker
- Risk score
- 47/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 25 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains revoked runtime tags. when an existing AMQP connection refreshes from an OAuth token that grants the impersonator tag to a valid same-username token that no longer grant…
- Affected
- Broadcom Rabbitmq Server before 3.13.19, 4.0.24, 4.1.15, 4.2.10, 4.3.5
- Fix
- Upgrade Broadcom Rabbitmq Server to 3.13.19, 4.0.24, 4.1.15, 4.2.10 or 4.3.5 (whichever matches your release line), or later.
- Exploitation
- Public proof of concept
Story map
At a glance
Broadcom Rabbitmq Server: Amber, patch this week. RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorization header or access_token cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token content to execute JavaScript in the management UI origin. T…
The flaws
- CVE-2026-67420: RabbitMQ is a messaging and streaming broker (CVSS 6.5 · EPSS 0%)
- CVE-2026-67237: RabbitMQ is a messaging and streaming broker (CVSS 9.3 · EPSS 0%)
- CVE-2026-66070: RabbitMQ is a messaging and streaming broker (CVSS 8.8 · EPSS 0%)
- CVE-2026-67231: RabbitMQ is a messaging and streaming broker (CVSS 9.1 · EPSS 0%)
The fix
Upgrade Broadcom Rabbitmq Server: 3.13.19 · 4.0.24 · 4.1.15 · 4.2.10 · 4.3.5 · 4.2.8 or later on your release line
Who is exposed: Broadcom Rabbitmq Server before 4.2.8, 4.3.2
Where it stands
- Public proof of concept
Connects to
- Same weakness: Missing authorisation (CWE-862). 399 other warnings in 30 days
- Same product: Earlier Broadcom Rabbitmq Server warnings. 45 in the last 90 days
Why it is Yellow
- CVSS 6.5 medium
- Public exploit or proof of concept referenced
References
- https://github.com/rabbitmq/rabbitmq-server/commit/5de287d213765ca592ff5848ad2f6b9b98ee6772
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.5
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-86fm-44m9-rqjx
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-86fm-44m9-rqjx
Original description
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains revoked runtime tags. when an existing AMQP connection refreshes from an OAuth token that grants the impersonator tag to a valid same-username token that no longer grants that tag, RabbitMQ updates the OAuth backend implementation (token/scopes/expiry) but leaves the connection's runtime #user.tags unchanged. rabbitaccesscontrol:checkuserid/2 then still honors the stale impersonator tag, so the connection (including newly opened channels) can continue publishing messages with a foreign AMQP userid after that privilege should have been revoked. A fresh connection using the downgraded token correctly refuses the same publish, proving the defect is stale session state rather than the token Limited to connections that once held impersonator and successfully refresh to a downgraded same-username rabbitauthbackendoauth2 (or an equivalent refresh-capable backend that returns tags) is enabled for This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.
Last activity 25 Sep 2026. Patch Forecast updates every hour.