CVE-2026-67411

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.17 RabbitMQ versions 4.0.x prior to 4.0.23 RabbitMQ versions 4.1.x prior to 4.1.14 RabbitMQ versions 4.2.x prior to 4.2.9 RabbitMQ versions 4.3.x prior to 4.3.3

Description Native MQTT and MQTT over WebSocket implementations behind a trusted PROXY Protocol frontend may lose the proxy-derived client address before the authentication path verifies loopback users. This causes the address between the frontend and the broker to be incorrectly treated as a loopback address. An attacker with valid credentials for an account restricted to loopback access can bypass this source-address restriction, although password authentication remains effective.

Recommendations Update to version 3.13.18 Update to version 4.0.23 Update to version 4.1.14 Update to version 4.2.9 Update to version 4.3.3