Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9 , 4.1.14, 4.0.24, and 3.13.18, Federation upstream in RabbitMQ skips vhost authorization allowing cross-vhost message access. what the bug lets you do. A policymaker on one vhost reads and drains messages out of another vhost it has no permission on. With the default ack-mode the source messages are consumed (deleted), not copied. Why that should not 1. Federation validates the upstream URI without any vhost-access Cross-vhost message read/drain from a per-vhost policymaker, breaking vhost tenancy This issue is fixed in versions 4.3.3, 4.2.9 , 4.1.14, 4.0.24, and 3.13.18.
This issue is fixed upstream in RabbitMQ 4.2.9 and 4.3.3. Fedora 45 and rawhide ship rabbitmq-server-4.3.7, and Fedora 44 ships rabbitmq-server-4.2.9, so both are already fixed. The Fedora 43 (4.0.9) status is still being evaluated.
FEDORA-2026-ea1afc0a7b (rabbitmq-server-4.0.9-7.fc43) has been submitted as an update to Fedora 43. https://bodhi.fedoraproject.org/updates/FEDORA-2026-ea1afc0a7b
FEDORA-2026-ea1afc0a7b has been pushed to the Fedora 43 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-ea1afc0a7b` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-ea1afc0a7b See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.