CVE-2026-67412Medium· 6.0▾ TwilightPoC availableRabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9 , 4.1.14, 4.0.24, and 3.13.18, Federation upstream in RabbitMQ skips vhost authorization allowing cross-vhost message access. what the bug lets you do. A policy…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 33 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9 , 4.1.14, 4.0.24, and 3.13.18, Federation upstream in RabbitMQ skips vhost authorization allowing cross-vhost message access. what the bug lets you do. A policymaker on one vhost reads and drains messages out of another vhost it has no permission on. With the default ack-mode the source messages are consumed (deleted), not copied. Why that should not 1. Federation validates the upstream URI without any vhost-access Cross-vhost message read/drain from a per-vhost policymaker, breaking vhost tenancy This issue is fixed in versions 4.3.3, 4.2.9 , 4.1.14, 4.0.24, and 3.13.18.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-67241Medium· 4.8RabbitMQ is a messaging and streaming broker
CVE-2026-61837Medium· 6.3RabbitMQ is a messaging and streaming broker
CVE-2026-67407Medium· 5.1RabbitMQ is a messaging and streaming broker
CVE-2026-67242Medium· 6.3RabbitMQ is a messaging and streaming broker
CVE-2026-67409High· 8.2RabbitMQ is a messaging and streaming broker
CVE-2026-67415Medium· 5.9RabbitMQ is a messaging and streaming broker