CVE-2026-66076

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.0

Description An issue exists where the is authorized/2 function calls rabbit mgmt util:is authorized/2, which only verifies the management tag instead of using is authorized vhost/2. Consequently, the '/api/queues/quorum/:vhost/:queue/status' endpoint reads the :vhost variable from the path without verifying if the user has access to it. A user with a management tag can read Raft status—including leader, members, term, and commit index—for quorum queues in vhosts they cannot access, potentially exposing cluster topology and cross-tenant queue names. This requires the management plugin to be enabled and the user to possess a management tag.

Recommendations Update to version 3.13.15. Update to version 4.0.20. Update to version 4.1.11. Update to version 4.2.6. Update to version 4.3.0.