CVE catalog
CVE-2026-67241
RabbitMQ is a messaging and streaming broker. From…
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, AMQP 1.0 management exchange.declare skips alternate-exchange permission check. pUT /exchanges/:name (lines 192-240) checks only configure on the declared exchange and passes XArgs straight to rabbitexchange:declare/7. It omits the checkreadpermitted(X) + checkwritepermitted(AE) that rabbitchannel.erl:2540-2548 enforces for the alternate-exchange argument on the AMQP 0-9-1 path. The same file already implements the analogous DLX check for queues (lines 708-719), confirming this is a missing-check bug rather than intentional A user with only configure on exchange X can route X's unroutable messages into an alternate exchange they have no write permission AMQP 1.0 enabled (default in RabbitMQ 4.x) Attacker has configure on at least one exchange but lacks write on the target. This issue is fixed in versions 4.2.9 and 4.3.3.
- Severity
- Medium · CVSS 4.8
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.43% · Oct 27, 2026
Projects and upstream resources
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
Version impact has not been established. The original provider fields are retained below.
Provider details and historical evidence
Original provider fields
{
"package_releases": [
{
"name": "rabbitmq-server",
"status": "fixed",
"release": "sid",
"version": "4.3.6-1"
},
{
"name": "rabbitmq-server",
"status": "fixed",
"release": "forky",
"version": "4.3.6-1"
},
{
"name": "rabbitmq-server",
"status": "not affected",
"release": "trixie",
"version": "4.0.5-6+deb13u2"
},
{
"name": "rabbitmq-server",
"status": "not affected",
"release": "bookworm",
"version": "3.10.8-1.1+deb12u1"
},
{
"name": "rabbitmq-server",
"status": "not affected",
"release": "bookworm-security",
"version": "3.10.8-1.1+deb12u1"
}
],
"fixed_versions": [
{
"bug": 1149180,
"name": "rabbitmq-server",
"type": "source",
"origin": null,
"release": "sid",
"urgency": "not yet assigned",
"fixed_version": "4.3.6-1"
},
{
"bug": 1149180,
"name": "rabbitmq-server",
"type": "source",
"origin": null,
"release": "forky",
"urgency": "not yet assigned",
"fixed_version": "4.3.6-1"
},
{
"bug": 1149180,
"name": "rabbitmq-server",
"type": "source",
"origin": null,
"release": "trixie",
"urgency": "unimportant",
"fixed_version": "0"
},
{
"bug": 1149180,
"name": "rabbitmq-server",
"type": "source",
"origin": null,
"release": "bookworm",
"urgency": "unimportant",
"fixed_version": "0"
}
],
"distribution_packages": [
{
"name": "rabbitmq_server",
"ranges": [
{
"fixed": "4.3.3",
"introduced": "4.3.0",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "4.3.3",
"provider_record_id": "NVD-CVE-2026-67241"
},
{
"name": "rabbitmq",
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.9"
},
{
"introduced": "4.3.0"
},
{
"fixed": "4.3.3"
}
]
}
],
"versions": [],
"ecosystem": "Bitnami",
"fixed_version": "4.2.9",
"provider_record_id": "BIT-RABBITMQ-2026-67241"
},
{
"name": "rabbitmq-server",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "pro",
"versions": [
"3.7.8-4ubuntu2",
"3.7.18-1",
"3.8.2-0ubuntu1",
"3.8.2-0ubuntu1.1",
"3.8.2-0ubuntu1.2",
"3.8.2-0ubuntu1.3",
"3.8.2-0ubuntu1.4",
"3.8.2-0ubuntu1.5",
"3.8.3-0ubuntu0.1",
"3.8.3-0ubuntu0.2",
"3.8.3-0ubuntu0.3",
"3.8.3-0ubuntu0.3+esm1",
"3.8.3-0ubuntu0.3+esm2"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-67241"
},
{
"name": "rabbitmq-server",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "22.04",
"versions": [
"3.8.9-3ubuntu1",
"3.9.8-1",
"3.9.8-2",
"3.9.8-3",
"3.9.8-5",
"3.9.8-6",
"3.9.13-1",
"3.9.13-1ubuntu0.22.04.1",
"3.9.13-1ubuntu0.22.04.2",
"3.9.27-0ubuntu0.1",
"3.9.27-0ubuntu0.2",
"3.9.27-0ubuntu0.5",
"3.9.27-0ubuntu0.6"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-67241"
},
{
"name": "rabbitmq-server",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "24.04",
"versions": [
"3.12.1-1",
"3.12.1-1ubuntu1",
"3.12.1-1ubuntu1.2",
"3.12.1-1ubuntu1.4",
"3.12.1-1ubuntu1.6",
"3.12.1-1ubuntu1.7"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-67241"
},
{
"name": "rabbitmq-server",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "26.10",
"versions": [
"4.0.5-10ubuntu5",
"4.3.2-4ubuntu2",
"4.3.2-4ubuntu3"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-67241"
},
{
"name": "rabbitmq-server",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "26.04",
"versions": [
"4.0.5-8ubuntu2",
"4.0.5-10ubuntu1",
"4.0.5-10ubuntu2",
"4.0.5-10ubuntu3",
"4.0.5-10ubuntu4",
"4.0.5-10ubuntu5",
"4.0.5-10ubuntu5.1",
"4.0.5-10ubuntu5.2"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-67241"
}
]
}OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [rabbitmq-server]Unknown
Details (4)
3.10.8-1.1+deb12u1· all · bookwormNot affected
nvd · rabbitmq-server · debian · bookworm
3.10.8-1.1+deb12u1· all · bookwormNot affected
nvd · rabbitmq-server · debian · bookworm
3.10.8-1.1+deb12u1· all · bookworm-securityNot affected
nvd · rabbitmq-server · debian · bookworm
3.10.8-1.1+deb12u1· all · bookworm-securityNot affected
nvd · rabbitmq-server · debian · bookworm
Observed:
References
- [https://ftp.suse.com/pub/projects/security/]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-67241]
- [https://osv.dev/vulnerability/BIT-rabbitmq-2026-67241]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-67241]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-67241]
- [https://security-tracker.debian.org/tracker/CVE-2026-67241]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67241.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2485.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]