CVE-2026-66075: RabbitMQ Privilege Escalation Vulnerability

CVE-2026-66075 Overview

CVE-2026-66075 is a missing authorization vulnerability [CWE-862] in RabbitMQ, an open-source messaging and streaming broker. The flaw resides in the /federation-links/.../restart route of the federation management plugin. The is_authorized/2 handler uses is_authorized_monitor, which accepts the monitoring tag, while allowed_methods permits DELETE and delete_resource/2 triggers rabbit_federation_link_sup:restart. As a result, a read-only user holding the monitoring tag can restart any federation link and disrupt message flow.

Critical Impact
Authenticated users with only the monitoring tag can invoke a state-changing federation link restart, causing message flow disruption on brokers with the rabbitmq_federation and rabbitmq_federation_management plugins enabled.

Affected Products

RabbitMQ 3.13.x prior to 3.13.15
RabbitMQ 4.0.x prior to 4.0.20, 4.1.x prior to 4.1.11, 4.2.x prior to 4.2.6
RabbitMQ 4.3.x prior to 4.3.1

Discovery Timeline

2026-09-23 - CVE-2026-66075 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-66075

Vulnerability Analysis

RabbitMQ enforces role-based access using tags such as administrator, management, and monitoring. The monitoring tag is intended to grant read-only observability into broker state. Federation link restart is a state-changing operation that interrupts inter-broker message replication.

The federation management HTTP handler for /federation-links/{vhost}/{name}/restart declares DELETE in allowed_methods and implements the action in delete_resource/2, which invokes rabbit_federation_link_sup:restart. Authorization is gated only by is_authorized_monitor, which accepts the monitoring tag. There is no per-method elevation to require an administrative tag, and no source comment indicating the behavior is intentional.

Root Cause

The root cause is missing authorization [CWE-862] on a state-changing HTTP verb. Read-oriented handlers reused a monitor-level authorization predicate without enforcing a higher privilege check for the destructive DELETE path. The result is a mismatch between the semantic effect of the operation and the privilege required to execute it.

Attack Vector

Exploitation requires network access to the RabbitMQ management HTTP API and valid credentials tagged as monitoring. The attacker issues a DELETE request against /api/federation-links/{vhost}/{name}/restart. The broker restarts the targeted federation link, disrupting message flow between federated brokers. Preconditions include both the rabbitmq_federation and rabbitmq_federation_management plugins being enabled.

The vulnerability mechanism is documented in the GitHub Security Advisory GHSA-g5v3-w5xg-62q2. No public exploit code is required beyond a standard HTTP client authenticated as a monitoring user.

Detection Methods for CVE-2026-66075

Indicators of Compromise

HTTP DELETE requests to /api/federation-links/{vhost}/{name}/restart originating from accounts tagged only with monitoring.
Unexpected rabbit_federation_link_sup:restart events in broker logs correlated with monitoring-tagged principals.
Federation link state transitions (running → starting) without a corresponding change-management ticket or administrator action.

Detection Strategies

Ingest RabbitMQ management API access logs and alert on DELETE verbs against federation link endpoints performed by non-administrator users.
Correlate federation link restarts with the authenticated user tag from the management plugin audit trail.
Baseline expected federation link restart frequency per environment and alert on deviations.

Monitoring Recommendations

Forward RabbitMQ HTTP API access logs and broker logs to a centralized logging platform for long-term retention and query.
Enable and review the RabbitMQ management plugin's audit events for authorization decisions on federation routes.
Track user tag assignments in Identity and Access Management systems to identify accounts eligible to reach the vulnerable endpoint.

How to Mitigate CVE-2026-66075

Immediate Actions Required

Upgrade RabbitMQ to 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.1 depending on the deployed release branch.
Inventory all accounts holding the monitoring tag and validate that each requires access to the management HTTP API.
Restrict network access to the management API (default TCP 15672) to trusted operator networks.

Patch Information

The issue is fixed in RabbitMQ versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1. Release notes are published in the RabbitMQ v4.2.6 release and the RabbitMQ v4.3.1 release. Patched builds add a per-method elevation check so that federation link restart requires an administrative tag.

Workarounds

Disable the rabbitmq_federation_management plugin if federation link management via the HTTP API is not required.
Remove the monitoring tag from accounts that do not need read access to federation state, or replace them with tighter custom policies.
Place the management API behind a reverse proxy that blocks DELETE requests to /api/federation-links/*/restart for non-administrator principals until patching completes.

bash

# Disable the federation management plugin as a temporary workaround
rabbitmq-plugins disable rabbitmq_federation_management

# List users and their tags to audit monitoring-tag exposure
rabbitmqctl list_users

# Remove the monitoring tag from an account that does not require it
rabbitmqctl set_user_tags <username> ""