CVE-2026-67218: RabbitMQ Privilege Escalation Vulnerability

CVE-2026-67218 Overview

CVE-2026-67218 is a missing authorization vulnerability [CWE-862] in the RabbitMQ messaging and streaming broker. The flaw exists in the rabbitmq_stream_management plugin's HTTP handler for super-stream creation. Authenticated users with the management tag and virtual host access can create super-streams (an exchange, N partition stream queues, and bindings) without holding the configure permission required by the native stream protocol path. The issue affects RabbitMQ versions prior to 4.0.22, 4.1.11, 4.2.6, and 4.3.0.

Critical Impact
A low-privileged user with only view-level access can create persistent, cluster-wide messaging resources, escalating from read-only management access to resource creation without any configure permission.

Affected Products

RabbitMQ server versions prior to 4.0.22 (4.0.x branch)
RabbitMQ server versions prior to 4.1.11 and 4.2.6 (4.1.x and 4.2.x branches)
RabbitMQ deployments with the rabbitmq_stream_management plugin enabled

Discovery Timeline

2026-09-23 - CVE-2026-67218 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-67218

Vulnerability Analysis

The vulnerability resides in the accept_content/2 function at line 56 of the RabbitMQ stream management HTTP handler. The handler calls rabbit_stream_manager:create_super_stream/... directly after invoking is_authorized, which validates only the presence of the management tag and virtual host access via is_authorized_vhost. The equivalent native stream-protocol path in rabbit_stream_reader.erl invokes rabbit_stream_utils:check_super_stream_management_permitted/4, enforcing configure permission on the target exchange and each partition queue. The HTTP handler omits this authorization check entirely, producing an inconsistency between the two API surfaces.

An authenticated user meeting only the management tag and vhost access preconditions can create a full super-stream topology through the HTTP API. This escalates their effective capability from "can view" to "can create persistent cluster-wide resources." The created exchange, partition stream queues, and bindings persist across the cluster and consume broker resources.

Root Cause

The root cause is missing authorization [CWE-862] in the HTTP super-stream creation path. The developers implemented configure permission checks in the native stream-protocol handler but did not mirror the check in the HTTP handler. The is_authorized guard only validates coarse-grained management access, not per-resource configure rights.

Attack Vector

Exploitation requires network access to the RabbitMQ management HTTP API, a valid user account with the management tag, and access to at least one virtual host. No resource permissions are required on the target vhost. The attacker issues a super-stream creation request to the HTTP API endpoint. The server proceeds to create the exchange, partition queues, and bindings without validating that the caller holds configure permission on any resource.

Refer to the GitHub Security Advisory GHSA-34jw-rm7g-hph4 for detailed technical analysis.

Detection Methods for CVE-2026-67218

Indicators of Compromise

Creation of super-stream exchanges and partition stream queues by users lacking configure permission on the target virtual host.
Unexpected persistent stream queues appearing in the cluster topology, particularly with partition-style naming patterns.
HTTP API PUT requests to super-stream endpoints originating from accounts that hold only the management tag.

Detection Strategies

Audit RabbitMQ management HTTP access logs for super-stream creation requests and correlate the acting user against the vhost permission table.
Compare declared queues and exchanges against the permission grants of their creators to identify resources created without matching configure rights.
Enable RabbitMQ audit logging on queue, exchange, and binding declaration events to establish a baseline of authorized topology changes.

Monitoring Recommendations

Forward RabbitMQ management and audit logs to a centralized SIEM for continuous review of resource creation events.
Alert on any topology change originating from a user whose vhost permissions do not include configure regular expressions matching the created resource.
Track growth in the number of stream queues and exchanges per vhost to detect unauthorized resource proliferation.

How to Mitigate CVE-2026-67218

Immediate Actions Required

Upgrade RabbitMQ to a patched release: 4.0.22, 4.1.11, 4.2.6, or 4.3.0 or later.
Inventory all users holding the management tag and review the virtual hosts they can access.
Audit existing super-streams, stream queues, exchanges, and bindings to identify resources created by users without appropriate configure permission.

Patch Information

The issue is fixed in RabbitMQ versions 4.0.22, 4.1.11, 4.2.6, and 4.3.0. Release artifacts are available at the RabbitMQ v4.2.6 Release and RabbitMQ v4.3.0 Release pages. The patch adds the missing check_super_stream_management_permitted/4 invocation to the HTTP handler so it enforces the same configure requirements as the native stream protocol path.

Workarounds

Disable the rabbitmq_stream_management plugin if super-stream management via HTTP is not required.
Restrict network access to the management HTTP API to trusted administrative networks only.
Remove the management tag from accounts that do not require administrative HTTP API access, limiting the population of users who can reach the vulnerable endpoint.

bash

# Disable the vulnerable plugin until upgrade is possible
rabbitmq-plugins disable rabbitmq_stream_management

# Review users holding the management tag
rabbitmqctl list_users

# Review per-vhost permissions to identify accounts without configure rights
rabbitmqctl list_permissions -p /