CVE-2026-66078

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.14 RabbitMQ versions 4.0.x prior to 4.0.20 RabbitMQ versions 4.1.x prior to 4.1.11 RabbitMQ versions 4.2.x prior to 4.2.6

Description A protected tag bypass exists when the rabbitmqmanagement plugin is enabled. While the endpoint 'DELETE /api/users/:name' correctly prevents the deletion of users marked as protected by using the deleteresource/2 function to check isprotecteduser, the 'POST /api/users/bulk-delete' endpoint bypasses this safeguard. The bulk-delete process iterates through a list of usernames and calls the deleteuser/2 function directly, which lacks the protected-tag check. Consequently, a user with the administrator tag can delete protected-tagged service accounts.

Recommendations Update RabbitMQ to version 3.13.15. Update RabbitMQ to version 4.0.20. Update RabbitMQ to version 4.1.11. Update RabbitMQ to version 4.2.6.