Bug 2540096

Summary: CVE-2026-67218 rabbitmq-server: RabbitMQ: Privilege escalation via super-stream HTTP creation [fedora-all]
Product: [Fedora] Fedora Reporter: Jon Weiser <jweiser>
Component: rabbitmq-serverAssignee: Peter Lemenkov <lemenkov>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: lemenkov, rjones
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["c2a10e14-4789-4457-a840-373e156c8260"]}
Fixed In Version: rabbitmq-server-4.3.6-1.fc46 rabbitmq-server-4.3.6-1.fc45 rabbitmq-server-4.2.9-2.fc44 Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-10-09 15:44:15 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2539778    

Description Jon Weiser 2026-09-24 14:07:15 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

RabbitMQ is a messaging and streaming broker. Prior to versions 4.0.22, 4.1.11, 4.2.6, and 4.3.0, accept_content/2 at line 56 calls rabbit_stream_manager:create_super_stream/... directly after is_authorized (which only checks the management tag + vhost access via is_authorized_vhost). The stream-protocol equivalent (rabbit_stream_reader.erl create_super_stream handler) calls rabbit_stream_utils:check_super_stream_management_permitted/4 which enforces configure on the exchange and each partition queue. The HTTP handler omits this call entirely. A user with management tag and vhost access , but no configure permission on any resource , can create super-streams (an exchange + N partition stream queues + bindings) via the HTTP API. The native stream-protocol path enforces configure on each resource; the HTTP path does not, creating a privilege escalation from 'can view' to 'can create persistent cluster-wide resources.' Preconditions include rabbitmq_stream_management plugin enabled management tag + vhost access (no resource permissions needed). This issue is fixed in versions 4.0.22, 4.1.11, 4.2.6, and 4.3.0.
Comment 1 Peter Lemenkov 2026-10-09 13:24:24 UTC 
This issue is already fixed upstream in RabbitMQ 4.3.6, which is the version currently built for Fedora rawhide (rabbitmq-server-4.3.6-1.fc46) and Fedora 45 (rabbitmq-server-4.3.6-1.fc45).

Fedora 44 (currently 4.2.9) and Fedora 43 (currently 4.0.9) still need attention; backports/rebases for the still-supported stable branches are being worked on. Leaving this report open to track that remaining work.
Comment 2 Peter Lemenkov 2026-10-09 15:44:15 UTC 
This issue is already addressed in the rabbitmq-server builds currently shipped in all maintained Fedora branches:

  * Fedora rawhide: rabbitmq-server-4.3.6-1.fc46
  * Fedora 45:      rabbitmq-server-4.3.6-1.fc45
  * Fedora 44:      rabbitmq-server-4.2.9-2.fc44

No new build is required for these branches, so closing as CURRENTRELEASE.

Fedora 43 (rabbitmq-server-4.0.9) will NOT be updated for this CVE batch: the upstream 4.0.x line ended at 4.0.9 (later 4.0.x fixes are commercial-only, with no public OSS release) and Fedora 43 reaches end of life on 2026-12-09, so a backport to F43 is not worthwhile.