CVE-2026-66067 Overview
CVE-2026-66067 is a connection-limit bypass vulnerability in RabbitMQ, the open-source messaging and streaming broker. The rabbitmq_stream plugin's open handler invokes only check_vhost_access and omits the node, vhost, and user connection-limit checks that rabbit_reader enforces for AMQP. A developer %% FIXME comment at the affected line acknowledges the gap. An authenticated tenant can bypass operator-configured per-user and per-vhost connection caps by connecting on the stream port 5552 instead of the AMQP port 5672. The issue affects RabbitMQ releases prior to 4.2.7 and 4.3.1.
Critical Impact
Authenticated tenants can exhaust broker resources and break tenant isolation by bypassing per-user and per-vhost connection limits through the stream protocol port.
Affected Products
- RabbitMQ Server versions prior to 4.2.7 (4.2.x branch)
- RabbitMQ Server versions prior to 4.3.1 (4.3.x branch)
- Deployments with the rabbitmq_stream plugin enabled
Discovery Timeline
- 2026-09-23 - CVE-2026-66067 published to the National Vulnerability Database
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-66067
Vulnerability Analysis
The vulnerability is a missing-enforcement flaw categorized under [CWE-770] (Allocation of Resources Without Limits or Throttling). RabbitMQ's AMQP path in rabbit_reader enforces connection quotas at the node, vhost, and user levels before accepting a new client. The stream protocol path in rabbitmq_stream skips these checks entirely, retaining only vhost access authorization via check_vhost_access.
An attacker with valid stream-protocol credentials can open an unbounded number of concurrent connections against port 5552. This breaks tenant isolation in multi-tenant deployments where operators rely on connection caps to prevent noisy-neighbor conditions and resource monopolization. The impact is limited to availability, but the effect on shared broker infrastructure is direct.
Root Cause
The stream open handler was implemented without parity to the AMQP reader's admission-control logic. The source contains an explicit %% FIXME comment at the cited call site, indicating the omission was known but unresolved. Connection tracking elsewhere in rabbitmq_stream does not compensate for the missing checks.
Attack Vector
Exploitation requires an authenticated user with credentials for the stream protocol and a target deployment exposing port 5552. The attacker repeatedly opens stream connections to the target vhost. Because the plugin never consults the configured connection_max or per-user/per-vhost caps, connections accumulate until node resources are exhausted, regardless of operator-configured limits. See the GitHub Security Advisory GHSA-hwqx-2gfg-89qf for the vendor's technical description.
Detection Methods for CVE-2026-66067
Indicators of Compromise
- Sudden growth in concurrent connections on port 5552 from a single authenticated user or IP.
- Stream connection counts for a vhost exceeding the operator-configured per-vhost limit reported by AMQP tooling.
- Resource saturation (file descriptors, Erlang processes, memory) on broker nodes without a corresponding AMQP connection spike.
Detection Strategies
- Query rabbitmqctl list_stream_connections and compare the count against the intended per-user and per-vhost caps.
- Correlate connection_created events from the broker's event exchange with the authenticated user and protocol field to flag stream-protocol outliers.
- Baseline stream connection rates per tenant and alert on deviations that AMQP-based enforcement would normally block.
Monitoring Recommendations
- Forward RabbitMQ management metrics and connection logs to a centralized analytics platform for cross-tenant visibility.
- Track per-user connection counts across both port 5672 and 5552 to detect quota circumvention.
- Alert on any authenticated principal opening more stream connections than the configured connection_max value.
How to Mitigate CVE-2026-66067
Immediate Actions Required
- Upgrade RabbitMQ to version 4.2.7 (4.2.x branch) or 4.3.1 (4.3.x branch) as published in the RabbitMQ v4.2.7 release and RabbitMQ v4.3.1 release.
- Inventory all brokers with the rabbitmq_stream plugin enabled and prioritize multi-tenant deployments.
- Rotate stream-protocol credentials for tenants suspected of abuse and revoke unused accounts.
Patch Information
The RabbitMQ maintainers fixed CVE-2026-66067 in versions 4.2.7 and 4.3.1. Both releases add the missing node, vhost, and user connection-limit checks to the stream open handler so that enforcement matches the AMQP path.
Workarounds
- Disable the rabbitmq_stream plugin with rabbitmq-plugins disable rabbitmq_stream where stream messaging is not required.
- Block or firewall port 5552 for untrusted networks and restrict access to known application subnets.
- Enforce per-tenant network-level connection limits at the load balancer or firewall until upgrades are deployed.
# Disable the stream plugin as a temporary mitigation
rabbitmq-plugins disable rabbitmq_stream
# Verify the plugin is no longer enabled
rabbitmq-plugins list -e | grep rabbitmq_stream
# Confirm current server version after upgrade
rabbitmqctl version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.