CVE-2026-67224 Overview
CVE-2026-67224 is a path traversal vulnerability [CWE-22] in the RabbitMQ messaging and streaming broker. The flaw resides in the rabbitmq_tracing plugin, which fails to sanitize the name parameter supplied to PUT /api/traces/:vhost/:name. An authenticated user with the administrator tag can write .log-suffixed files to arbitrary filesystem paths writable by the rabbitmq OS user. The issue is fixed in RabbitMQ versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.
Critical Impact
Administrators can write attacker-controlled .log files outside the trace directory, potentially overwriting system files or planting content in locations such as /etc/cron.d/ when writable by the RabbitMQ service account.
Affected Products
- RabbitMQ Server versions prior to 3.13.15
- RabbitMQ Server 4.0.x prior to 4.0.20, 4.1.x prior to 4.1.11, and 4.2.x prior to 4.2.6
- RabbitMQ Server 4.3.x prior to 4.3.1 with the rabbitmq_tracing plugin enabled
Discovery Timeline
- 2026-09-23 - CVE-2026-67224 published to NVD
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-67224
Vulnerability Analysis
The RabbitMQ tracing plugin exposes an administrative endpoint that creates trace consumer files on disk. When a client issues PUT /api/traces/:vhost/:name, the server constructs the output path using filename:join(TraceDir, Name ++ ".log"), where Name originates directly from the URL path segment.
The write path does not invoke rabbit_misc:safe_relative_path/1, while the corresponding read path in rabbit_tracing_files.erl does perform the check. This asymmetry confirms the missing validation is an oversight rather than a design decision. Because the .log suffix is appended server-side, the attacker cannot control the file extension, but they can control the directory and base filename.
Root Cause
The root cause is missing relative-path validation on the write side of the tracing plugin. The Name value flows unchecked into filename:join/2, which permits traversal sequences such as ../ to escape the intended trace directory. Correct behavior would mirror the read path and reject any name that resolves outside the configured trace root.
Attack Vector
Exploitation requires the rabbitmq_tracing plugin to be enabled, an account with the administrator tag, and a target path writable by the rabbitmq OS user. An attacker submits a crafted name parameter containing directory traversal segments to the tracing API. The server then creates or overwrites a .log-suffixed file at the resolved path, for example /etc/cron.d/x.log. This can be used to overwrite existing .log files outside the trace directory or, on misconfigured hosts, to drop content into privileged directories.
No verified public exploit code is available. See the GitHub Security Advisory GHSA-h7cq-qrr8-7vgc for the maintainer's technical description.
Detection Methods for CVE-2026-67224
Indicators of Compromise
- Unexpected .log files appearing outside the configured RabbitMQ trace directory and owned by the rabbitmq user.
- HTTP requests to PUT /api/traces/:vhost/:name where the name segment contains ../, ..%2F, absolute paths, or other traversal sequences.
- Modifications to existing .log files in system directories such as /etc, /var/log, or scheduled task directories that coincide with tracing API activity.
Detection Strategies
- Enable RabbitMQ management HTTP access logging and alert on PUT /api/traces/ requests containing encoded or literal traversal patterns in the URL path.
- Audit filesystem events for .log file creations by the rabbitmq process outside its designated trace directory.
- Review administrator-tagged account activity in RabbitMQ for unexpected use of the tracing plugin API.
Monitoring Recommendations
- Forward RabbitMQ management API logs and OS-level file integrity events to a centralized analytics pipeline for correlation.
- Baseline legitimate tracing plugin usage per vhost so anomalous name values are easier to surface.
- Track plugin state changes to detect when rabbitmq_tracing is enabled on brokers that previously did not use it.
How to Mitigate CVE-2026-67224
Immediate Actions Required
- Upgrade RabbitMQ Server to 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.1 as appropriate for your release branch.
- Audit the roster of accounts holding the administrator tag and revoke unnecessary privileges.
- Inspect the RabbitMQ data and system directories for stray .log files that may indicate prior exploitation.
Patch Information
The RabbitMQ maintainers addressed the issue by applying rabbit_misc:safe_relative_path/1 on the tracing plugin's write path, matching the existing check on the read path. Fixed builds are published at RabbitMQ Server Release 4.2.6 and RabbitMQ Server Release 4.3.1. Full advisory context is available in GitHub Security Advisory GHSA-h7cq-qrr8-7vgc.
Workarounds
- Disable the rabbitmq_tracing plugin on brokers where tracing is not required.
- Restrict the rabbitmq OS user's filesystem permissions so that sensitive directories such as /etc/cron.d/ are not writable.
- Limit the administrator tag to a minimal set of trusted operators and enforce network-level restrictions on the management API.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.