CVE-2026-67233

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.1

Description An authorization bypass exists in the shovel management resource where the is authorized/2 function delegates to rabbit mgmt util:is authorized monitor/2. Because the allowed methods list includes DELETE and the delete resource/2 function performs deletions or restarts of shovel runtime parameters without additional role checks, a user with only the monitoring tag can perform state-changing operations. This allows a read-only monitoring user to delete or restart any dynamic shovel in any vhost they can access, an action that should be restricted to a policymaker. This issue requires the rabbitmq shovel and rabbitmq shovel management plugins to be enabled and the attacker to possess credentials with the monitoring tag.

Recommendations Update to version 3.13.15. Update to version 4.0.20. Update to version 4.1.11. Update to version 4.2.6. Update to version 4.3.1.