Bug 2541507 (CVE-2026-67412) - CVE-2026-67412 rabbitmq-server: RabbitMQ: Unauthorized cross-vhost message access via missing Federation upstream authorization
Summary: CVE-2026-67412 rabbitmq-server: RabbitMQ: Unauthorized cross-vhost message ac...
Keywords:
Status: NEW
Alias: CVE-2026-67412
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2566811
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-25 16:43 UTC by OSIDB Bzimport
Modified: 2026-11-04 10:23 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-25 16:43:29 UTC 
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9 , 4.1.14, 4.0.24, and 3.13.18, Federation upstream in RabbitMQ skips vhost authorization allowing cross-vhost message access. what the bug lets you do. A policymaker on one vhost reads and drains messages out of another vhost it has no permission on. With the default ack-mode the source messages are consumed (deleted), not copied. Why that should not 1. Federation validates the upstream URI without any vhost-access Cross-vhost message read/drain from a per-vhost policymaker, breaking vhost tenancy This issue is fixed in versions 4.3.3, 4.2.9 , 4.1.14, 4.0.24, and 3.13.18.
Note You need to log in before you can comment on or make changes to this bug.