CVE-2026-66075
Description
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, is_authorized/2 for the /federation-links/.../restart route uses is_authorized_monitor (accepts the monitoring tag), while allowed_methods permits DELETE and delete_resource/2 triggers rabbit_federation_link_sup:restart. There is no per-method elevation check and no comment marking it intentional. A read-only monitoring user can restart any federation link , a state-changing operation that disrupts message flow. Preconditions include rabbitmq_federation + rabbitmq_federation_management plugins enabled Attacker has credentials with the monitoring tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*Range: >=3.13.0,<3.13.15
- Range: <3.13.15, <4.0.20, <4.1.11, <4.2.6, <4.3.1
Patches
Vulnerability mechanics
References
3- github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-g5v3-w5xg-62q2nvdVendor Advisory
- github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6nvdRelease Notes
- github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1nvdRelease Notes
News mentions
1- RabbitMQ Server: 22 Vulnerabilities Disclosed Together, Ranging from Critical to Low SeverityVypr Intelligence · Sep 23, 2026