CVE-2026-66067

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 4.2.7 RabbitMQ versions prior to 4.3.1

Description The stream open handler only executes check vhost access and fails to perform the node, vhost, and user connection-limit checks typically handled by rabbit reader for AMQP. This omission allows an authenticated tenant to bypass operator-configured per-user and per-vhost connection caps by connecting via port 5552 instead of port 5672. This occurs when the rabbitmq stream plugin is enabled and the operator relies on these connection limits for tenant isolation.

Recommendations Update to version 4.2.7. Update to version 4.3.1.