CVE-2026-67224

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.1

Description An issue exists in the trace consumer where the output path is constructed without a safe relative path or traversal check on the write side. A user with the administrator tag can exploit this by using the name parameter in the 'PUT /api/traces/:vhost/:name' endpoint to write a file with a .log suffix to an arbitrary filesystem path writable by the rabbitmq OS user, or overwrite existing .log files outside the trace directory. This requires the rabbitmq tracing plugin to be enabled.

Recommendations Update RabbitMQ to version 3.13.15 or later. Update RabbitMQ to version 4.0.20 or later. Update RabbitMQ to version 4.1.11 or later. Update RabbitMQ to version 4.2.6 or later. Update RabbitMQ to version 4.3.1 or later. As a temporary mitigation, disable the rabbitmq tracing plugin.