---
id: CVE-2026-67420
title: RabbitMQ is a messaging and streaming broker
summary: >-
  RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19,
  4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains
  revoked runtime tags. when an existing AMQP connection refreshes from an OAuth
  token th…
severity: low
cvss: 2.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-862
  - CWE-266
vendor: rabbitmq
product: rabbitmq-server
affected:
  - 'rabbitmq-server >= 3.13.0, < 3.13.19'
  - 'rabbitmq-server >= 4.0.0, < 4.0.24'
  - 'rabbitmq-server >= 4.1.0, < 4.1.15'
  - 'rabbitmq-server >= 4.2.0, < 4.2.10'
  - 'rabbitmq-server >= 4.3.0, < 4.3.5'
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T17:17:13.973'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67420'
references:
  - url: >-
      https://github.com/rabbitmq/rabbitmq-server/commit/5de287d213765ca592ff5848ad2f6b9b98ee6772
    label: security-advisories@github.com
  - url: 'https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.5'
    label: security-advisories@github.com
  - url: >-
      https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-86fm-44m9-rqjx
    label: security-advisories@github.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67420.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-67420'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2541535'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-67420'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67420'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
cvssSource: cna
ingestedAt: '2026-09-25T17:13:14.017Z'
scores:
  cna: 2.3
  vendor: 3.1
---

## Overview

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains revoked runtime tags. when an existing AMQP connection refreshes from an OAuth token that grants the impersonator tag to a valid same-username token that no longer grants that tag, RabbitMQ updates the OAuth backend implementation (token/scopes/expiry) but leaves the connection's runtime #user.tags unchanged. rabbitaccesscontrol:checkuserid/2 then still honors the stale impersonator tag, so the connection (including newly opened channels) can continue publishing messages with a foreign AMQP userid after that privilege should have been revoked. A fresh connection using the downgraded token correctly refuses the same publish, proving the defect is stale session state rather than the token Limited to connections that once held impersonator and successfully refresh to a downgraded same-username rabbitauthbackendoauth2 (or an equivalent refresh-capable backend that returns tags) is enabled for This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Hardened Images, Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0 · no fix planned: Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat Hardened Images, … · updated 2026-09-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67420.json)