CVE-2026-67241: RabbitMQ Auth Bypass Vulnerability

CVE-2026-67241 Overview

CVE-2026-67241 is a missing authorization vulnerability [CWE-862] in RabbitMQ, affecting the AMQP 1.0 management interface. The flaw exists in PUT /exchanges/:name handling within rabbit_amqp_management.erl, which validates only the configure permission on the declared exchange. The handler passes XArgs directly to rabbit_exchange:declare/7 without enforcing the check_read_permitted(X) and check_write_permitted(AE) checks applied on the AMQP 0-9-1 path. A user with configure permission on an exchange can therefore set an alternate-exchange they lack write permission on, routing unroutable messages into it. The issue affects versions 4.2.0 through 4.2.8 and 4.3.0 through 4.3.2.

Critical Impact

Authenticated users with configure rights on any exchange can route messages into alternate exchanges they are not authorized to write to, bypassing RabbitMQ's permission model.

Affected Products

• RabbitMQ Server versions 4.2.0 through 4.2.8
• RabbitMQ Server versions 4.3.0 through 4.3.2
• Deployments with AMQP 1.0 enabled (default in RabbitMQ 4.x)

Discovery Timeline

• 2026-09-25 - CVE-2026-67241 published to NVD
• 2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-67241

Vulnerability Analysis

The vulnerability resides in RabbitMQ's AMQP 1.0 management request handler, specifically in rabbit_amqp_management.erl at lines 192-240. When a client issues a PUT /exchanges/:name request, the server verifies only the configure permission on the exchange being declared. It then forwards exchange arguments (XArgs) directly to rabbit_exchange:declare/7 without additional validation.

On the AMQP 0-9-1 path, rabbit_channel.erl at lines 2540-2548 enforces two additional checks when the alternate-exchange argument is present: check_read_permitted(X) on the source exchange and check_write_permitted(AE) on the alternate exchange. The AMQP 1.0 handler omits both checks. The same source file enforces the analogous dead-letter-exchange (DLX) check for queues at lines 708-719, confirming the omission is a bug rather than intentional behavior.

Root Cause

The root cause is a missing authorization check [CWE-862] on protocol-boundary parity. The AMQP 1.0 management code path never calls check_write_permitted against the alternate exchange target supplied in XArgs, while the AMQP 0-9-1 path does. The permission model assumes equivalent enforcement across both protocols, but the AMQP 1.0 declare path short-circuits that assumption.

Attack Vector

An authenticated attacker needs AMQP 1.0 access and configure permission on at least one exchange in the target virtual host. The attacker issues a PUT /exchanges/:name request supplying an alternate-exchange argument that targets an exchange they do not control. Once declared, any unroutable message published to the source exchange is forwarded into the attacker-selected alternate exchange, violating tenant isolation and the write-permission boundary.

%% Patch excerpt: deps/rabbit/src/rabbit_amqp_management.erl
%% Introduces explicit alternate-exchange permission check
-ifdef(TEST).
-export([check_routing_arg/5,
         check_alternate_exchange/4,
         check_dead_letter_exchange/4]).
-endif.

-type permission_caches() :: {rabbit_amqp_session:permission_cache(),
                              rabbit_amqp_session:topic_permission_cache()}.

-define(DEAD_LETTER_EXCHANGE_KEY, <<"x-dead-letter-exchange">>).
-define(ALTERNATE_EXCHANGE_KEY, <<"alternate-exchange">>).

Source: RabbitMQ Server Commit 18eac8d

Detection Methods for CVE-2026-67241

Indicators of Compromise

• AMQP 1.0 management PUT /exchanges/:name requests from accounts that hold only configure permissions on the targeted exchange.
• Exchange declarations where the alternate-exchange argument references an exchange owned by a different user, service account, or tenant.
• Unexpected message flow into exchanges whose write-permission ACL does not include the publishing user.

Detection Strategies

• Audit broker logs for exchange declaration events on the AMQP 1.0 path and correlate the declaring user against the permissions on both the source and alternate exchanges.
• Compare the declaring principal's write permission regex against the alternate-exchange value supplied in XArgs; flag mismatches.
• Baseline normal cross-exchange routing patterns per vhost and alert on new alternate-exchange bindings that cross trust boundaries.

Monitoring Recommendations

• Enable RabbitMQ audit logging for management-protocol operations and ship events to a centralized SIEM for correlation.
• Monitor rabbit_exchange:declare/7 invocations and surface declarations containing the alternate-exchange key.
• Track per-user exchange-declaration rates to detect scripted enumeration of alternate-exchange targets.

How to Mitigate CVE-2026-67241

Immediate Actions Required

• Upgrade RabbitMQ Server to version 4.2.9 or 4.3.3, which add the missing check_alternate_exchange/4 enforcement.
• Inventory existing exchanges that use the alternate-exchange argument and verify the declaring user holds write permission on the target.
• Review user permissions in each vhost and remove unnecessary configure grants that could be leveraged for cross-exchange routing.

Patch Information

The fix is delivered in RabbitMQ Server Release v4.2.9 and RabbitMQ Server Release v4.3.3. Technical details are documented in GitHub Security Advisory GHSA-rg2g-289m-xhhw and in commits 18eac8d and 56005e7.

Workarounds

• Disable the AMQP 1.0 plugin if it is not required by production workloads, removing the vulnerable code path.
• Restrict configure permissions so that only trusted administrative accounts can declare or modify exchanges.
• Enforce strict per-vhost separation so that configure-capable users cannot reference exchanges owned by other tenants.

# Disable the AMQP 1.0 plugin as a temporary mitigation
rabbitmq-plugins disable rabbitmq_amqp1_0

# Audit user permissions per vhost
rabbitmqctl list_user_permissions <username>
rabbitmqctl list_permissions -p <vhost>