CVE-2026-66076: RabbitMQ Information Disclosure Vulnerability

CVE-2026-66076 Overview

CVE-2026-66076 is a broken access control vulnerability [CWE-862] in RabbitMQ, an open-source messaging and streaming broker. The flaw resides in the management plugin's /api/queues/quorum/:vhost/:queue/status handler. The endpoint calls is_authorized/2, which validates only the management tag rather than delegating to is_authorized_vhost/2 to enforce virtual host (vhost) scoping. Any authenticated user holding a management tag can read Raft consensus status, including leader, members, term, and commit index, for quorum queues in vhosts they do not have permission to access. The disclosure exposes cross-tenant queue names and cluster topology. Fixes are shipped in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

Critical Impact
Management-tagged users can enumerate quorum queue names and Raft cluster topology across vhost boundaries, breaking tenant isolation in shared RabbitMQ clusters.

Affected Products

RabbitMQ versions prior to 3.13.15
RabbitMQ 4.0.x prior to 4.0.20, 4.1.x prior to 4.1.11, and 4.2.x prior to 4.2.6
RabbitMQ deployments with the management plugin enabled

Discovery Timeline

2026-09-23 - CVE-2026-66076 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-66076

Vulnerability Analysis

RabbitMQ's HTTP management API enforces access control through per-endpoint authorization callbacks. The quorum queue status handler at /api/queues/quorum/:vhost/:queue/status reads the vhost value from the request path but does not validate that the authenticated principal has permissions on that vhost. Instead, the handler invokes rabbit_mgmt_util:is_authorized/2, which checks only whether the user carries a management tag such as management, monitoring, policymaker, or administrator.

Because the check ignores vhost membership, any tagged user can query Raft consensus state for quorum queues belonging to other tenants. Returned fields include the leader node, member set, current term, and commit index. This leaks queue names, node identities, and cluster topology that a multi-tenant deployment expects to segment by vhost.

Root Cause

The root cause is a missing authorization check [CWE-862]. The handler uses is_authorized/2 when it should use is_authorized_vhost/2, which resolves the vhost from the request path and verifies the user's permissions against it. The fix substitutes the correct authorization helper.

Attack Vector

Exploitation requires network access to the management HTTP API, valid credentials for any user with a management tag, and the management plugin enabled. The attacker issues an authenticated GET request against /api/queues/quorum/<target-vhost>/<queue-name>/status for a vhost they do not own. RabbitMQ returns the Raft status object, exposing internal topology. No user interaction and no privilege escalation on the underlying host are required.

No verified public exploit code is available. The vulnerability behavior is documented in GitHub Security Advisory GHSA-j45q-v7g2-82ph.

Detection Methods for CVE-2026-66076

Indicators of Compromise

HTTP GET requests to /api/queues/quorum/<vhost>/<queue>/status where the requesting user has no configured permissions on the target vhost.
Repeated management API requests iterating through vhost or queue names, indicating enumeration.
Management API access from user accounts that historically never queried quorum queue endpoints.

Detection Strategies

Enable and forward RabbitMQ management plugin access logs, then correlate the authenticated username against rabbitmqctl list_user_permissions output to flag cross-vhost access.
Build a detection rule that alerts when a user requests quorum queue status for a vhost outside their permission set.
Baseline normal management API usage per service account and alert on deviations that resemble topology enumeration.

Monitoring Recommendations

Ship RabbitMQ HTTP access logs to a centralized log platform and retain them for tenant-boundary audits.
Track the ratio of 4xx to 2xx responses per user on /api/queues/* endpoints to surface reconnaissance.
Monitor creation and tag changes for management users, especially additions of the management, monitoring, or policymaker tags.

How to Mitigate CVE-2026-66076

Immediate Actions Required

Upgrade RabbitMQ to 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.0 or later, matching your current release branch.
Audit all users with management tags and remove tags from accounts that do not require management API access.
Review vhost permission assignments and revoke unused tenant access.

Patch Information

The RabbitMQ maintainers fixed the issue by replacing the is_authorized/2 call in the quorum queue status handler with is_authorized_vhost/2, which enforces per-vhost authorization. Patched versions are listed in the RabbitMQ v4.2.6 release notes and the GitHub Security Advisory GHSA-j45q-v7g2-82ph.

Workarounds

Disable the management plugin on production brokers where it is not required by running rabbitmq-plugins disable rabbitmq_management.
Restrict network exposure of the management HTTP listener (default TCP 15672) to trusted administrative networks only.
Reduce the number of accounts carrying management tags to the minimum required for operations.

bash

# Disable the management plugin if not required
rabbitmq-plugins disable rabbitmq_management

# Remove a management tag from a user that does not need API access
rabbitmqctl set_user_tags <username> ""

# Audit current user tags and vhost permissions
rabbitmqctl list_users
rabbitmqctl list_user_permissions <username>