CVE-2026-67233 Overview
CVE-2026-67233 is a missing authorization vulnerability [CWE-862] in the RabbitMQ messaging and streaming broker. The flaw affects the shovel management plugin's authorization logic, where the is_authorized/2 function delegates to rabbit_mgmt_util:is_authorized_monitor/2. This permits any account holding the monitoring tag to invoke the DELETE method against shovel runtime parameters. The equivalent /api/parameters endpoint correctly restricts such state-changing operations to the policymaker role, but the shovel management route does not. The issue is fixed in RabbitMQ versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.
Critical Impact
An authenticated user with the read-only monitoring tag can delete or restart any dynamic shovel in any vhost they can see, disrupting message routing across the broker.
Affected Products
- RabbitMQ Server versions prior to 3.13.15
- RabbitMQ Server 4.0.x prior to 4.0.20, 4.1.x prior to 4.1.11, and 4.2.x prior to 4.2.6
- RabbitMQ Server 4.3.x prior to 4.3.1 with rabbitmq_shovel and rabbitmq_shovel_management plugins enabled
Discovery Timeline
- 2026-09-24 - CVE-2026-67233 published to NVD
- 2026-09-25 - Last updated in NVD database
Technical Details for CVE-2026-67233
Vulnerability Analysis
RabbitMQ exposes dynamic shovels, which are runtime parameters that configure message replication between queues or exchanges. The shovel management plugin provides an HTTP API for managing these shovels. The resource handler for shovel management defines allowed_methods to include GET and DELETE. The is_authorized/2 callback should enforce role-based access, but it delegates authorization to rabbit_mgmt_util:is_authorized_monitor/2, which only verifies the caller holds the monitoring tag.
The delete_resource/2 handler then removes or restarts the shovel runtime parameter without performing any additional role check. The equivalent generic parameters endpoint at /api/parameters correctly gates deletion behind the policymaker role, creating an inconsistent authorization surface across the broker's management API.
Root Cause
The vulnerability stems from improper authorization enforcement in the shovel management resource. The monitoring tag is designed to grant read-only visibility into broker state. By routing a destructive DELETE operation through an authorization check tuned for read access, the plugin violates least privilege and permits state-changing actions by read-only principals.
Attack Vector
An attacker needs valid credentials for an account with the monitoring tag and network access to the RabbitMQ management interface. The attacker issues an HTTP DELETE request against the shovel management endpoint for any shovel visible to the account's vhost permissions. The broker removes or restarts the targeted dynamic shovel, interrupting message flow between source and destination endpoints. Repeated requests across multiple shovels can disrupt broker-wide replication and integration pipelines.
No verified public exploit code is available. See the GitHub Security Advisory GHSA-7jc3-73v6-rjvc for technical details.
Detection Methods for CVE-2026-67233
Indicators of Compromise
- HTTP DELETE requests to /api/shovels/vhost/<name> or /api/parameters/shovel/<vhost>/<name> originating from accounts tagged monitoring rather than policymaker or administrator.
- Unexpected shovel restarts or disappearances reflected in rabbitmqctl list_parameters output.
- Gaps in cross-cluster or cross-broker message replication correlated with management API activity.
Detection Strategies
- Audit RabbitMQ management plugin access logs for DELETE methods against shovel resources and correlate the authenticated user's tags.
- Alert on any state-changing shovel API call performed by a principal whose tags include only monitoring.
- Baseline the frequency of dynamic shovel parameter deletions and flag deviations against the baseline.
Monitoring Recommendations
- Forward RabbitMQ management HTTP access logs and rabbit_event audit records to a centralized log platform.
- Monitor the parameter.cleared and shovel.worker.status events for unexpected activity outside maintenance windows.
- Track authentication activity for all accounts tagged monitoring and alert on calls to non-read endpoints.
How to Mitigate CVE-2026-67233
Immediate Actions Required
- Upgrade RabbitMQ to a fixed version: 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.1.
- Review all user accounts with the monitoring tag and remove unnecessary assignments.
- Rotate credentials for any monitoring account whose exposure cannot be verified.
Patch Information
Upgrade to RabbitMQ 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.1. Release notes are available at the RabbitMQ 4.2.6 release and the RabbitMQ 4.3.1 release. Full advisory details are published in GHSA-7jc3-73v6-rjvc.
Workarounds
- Disable the rabbitmq_shovel_management plugin where upgrades cannot be deployed immediately, retaining shovel runtime functionality via rabbitmq_shovel without the HTTP management surface.
- Restrict network access to the management interface so only trusted operator subnets can reach it.
- Remove the monitoring tag from accounts that do not strictly require broker visibility and prefer per-vhost permissions.
# Disable the shovel management HTTP plugin as a temporary mitigation
rabbitmq-plugins disable rabbitmq_shovel_management
# Verify remaining enabled plugins
rabbitmq-plugins list -e
# Audit users and their tags
rabbitmqctl list_users
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
