RabbitMQ Server: 22 Vulnerabilities Disclosed Together, Ranging from Critical to Low Severity
RabbitMQ Server patched 22 vulnerabilities disclosed on 2026-09-23, ranging from critical to low severity, affecting multiple versions.
Key findings
- Critical CVE-2026-67404 allows MITM attacks due to insecure SSL fallback without CA bundle.
- High severity flaws include message size validation bypass (CVE-2026-67235) and atom coercion issues (CVE-2026-67238).
- Multiple vulnerabilities stem from insufficient input validation in handlers and API endpoints.
- Authorization checks are weak in several components, including management APIs and stream handlers.
- Patches are available for numerous RabbitMQ Server versions, with specific fixes detailed in advisories.
- All 22 CVEs were disclosed within a single hour on 2026-09-23, indicating a coordinated release.
On September 23, 2026, a significant batch of 22 vulnerabilities was disclosed for RabbitMQ Server, affecting multiple versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.0, and in some cases, later versions such as 4.2.7 and 4.3.1. These vulnerabilities span a range of severities, including critical, high, medium, and low, indicating a broad impact on the security posture of the messaging broker. The disclosures highlight issues in various components, including authentication, authorization, message handling, and plugin functionalities.
Several vulnerabilities revolve around improper validation of user-supplied input, leading to potential security bypasses or denial-of-service conditions. For instance, CVE-2026-67405 and CVE-2026-67220 highlight flaws in the Web-MQTT and Web-STOMP handlers, and binding creation respectively, where the Origin header and routing keys are not adequately validated, potentially allowing for cross-site scripting or resource exhaustion. Similarly, CVE-2026-67235 points to a critical issue where the BodySize is not validated against max_message_size, allowing clients to stream excessively large messages, leading to resource exhaustion.
Authorization and access control appear to be recurring themes. CVE-2026-67404 describes a critical vulnerability where, in the absence of a CA bundle, SSL options fall back to verify_none without warning, enabling man-in-the-middle attacks if an attacker can forge the JWKS response. CVE-2026-67231 details how the trust-store plugin can be manipulated to accept untrusted certificates due to an overridden verify_fun. Furthermore, CVE-2026-66075 and CVE-2026-66069 reveal that certain API endpoints related to federation links and core metrics incorrectly use less restrictive authorization checks, potentially allowing unauthorized access or manipulation. CVE-2026-66068 points out that plaintext URIs with credentials can be exposed in debug logs.
Other vulnerabilities include issues with atom handling and regular expression processing. CVE-2026-67228 and CVE-2026-67238 describe how arbitrary values can be coerced into atoms, potentially leading to unexpected behavior or denial of service. CVE-2026-67224 and CVE-2026-66074 highlight path traversal and regular expression processing issues, where user-supplied names for trace logs or resource filtering are not properly sanitized, potentially allowing attackers to access or manipulate files outside the intended directories. CVE-2026-66079 details a flaw in array parsing that could lead to memory exhaustion.
The affected versions span a wide range of RabbitMQ Server releases, indicating a need for widespread patching. The vendor has released patches for these issues, with specific versions listed as fixed, including 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.0, and later updates for some specific CVEs like 4.2.7, 4.3.1, 4.0.22, 4.1.13, and 3.13.17. Users are strongly advised to consult the official RabbitMQ advisories and update to the patched versions to mitigate these security risks.
This coordinated disclosure of 22 vulnerabilities underscores the importance of regular security audits and timely patching for critical infrastructure components like RabbitMQ. The variety of issues, from authentication bypasses to resource exhaustion and information disclosure, necessitates a thorough review of security configurations and prompt application of updates.
Key findings from this batch include:
- A critical vulnerability (CVE-2026-67404) allows man-in-the-middle attacks due to improper SSL fallback behavior.
- Multiple high-severity flaws (e.g., CVE-2026-67235, CVE-2026-66079, CVE-2026-67238) relate to message size validation, array parsing, and atom coercion, potentially leading to denial-of-service or unauthorized access.
- Several medium-severity vulnerabilities involve insecure handling of headers, routing keys, and credentials, impacting authentication and logging.
- Authorization checks were found to be insufficient in various components, including management APIs and stream handlers.
- Patches are available across multiple RabbitMQ Server versions, with specific fixes detailed in vendor advisories.
- The disclosure window of 1 hour for all 22 CVEs suggests a coordinated release by the security researchers or the vendor.
CVE-2026-67405, CVE-2026-67404, CVE-2026-67240, CVE-2026-67235, CVE-2026-67231, CVE-2026-67229, CVE-2026-67228, CVE-2026-67224, CVE-2026-67220, CVE-2026-67219, CVE-2026-67218, CVE-2026-66080, CVE-2026-66075, CVE-2026-66074, CVE-2026-66072, CVE-2026-66069, CVE-2026-66068, CVE-2026-66067, CVE-2026-67238, CVE-2026-66079, CVE-2026-66076, CVE-2026-66070.