CVE-2026-67224
LowCVSS 2.1Summary
In RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, the trace consumer constructs the output path without a safe relative path check, even though the read side performs such a check. An administrator can use the name parameter to write a .log-suffixed file to an arbitrary filesystem path writable by the rabbitmq user, e.g. /etc/cron.d/x.log.
Risk Assessment
A user with the administrator tag can overwrite or create .log files outside the trace directory, potentially leading to code execution or system integrity compromise. Requires the rabbitmq_tracing plugin enabled and a writable target path.
Recommendation
Upgrade RabbitMQ to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.1. Restrict the rabbitmq user's filesystem permissions and consider disabling the rabbitmq_tracing plugin if not needed.
Other vulnerabilities in RabbitMQ
See all- CVE-2026-67405Medium
RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 does not validate the Origin header on WebSocket upgrade in the Web-MQTT and Web-STOMP handlers. With ssl_cert_login=true, the browser automatically presents the client certificate, so attacker JavaScript in the victim's browser can authenticate as the victim.
- CVE-2026-67240Low
RabbitMQ before versions 4.2.7 and 4.3.1 does not enforce an explicit match limit when compiling LIKE patterns into regular expressions, allowing an authenticated AMQP 1.0 consumer with read and write permissions on a stream queue to cause significant CPU consumption via a crafted LIKE filter. Each delivered message can cause about 100-200 ms of CPU load, amplified across thousands of messages and parallel sessions. The issue is fixed in versions 4.2.7 and 4.3.1.
- CVE-2026-67235High
RabbitMQ prior to versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15 stores the content-header BodySize (a uint64) without validation against max_message_size. A client can declare body_size = 2^63-1 and stream fragments so the size check never fires, causing the reader process to accumulate unbounded memory. This leads to node memory exhaustion or a memory alarm, degrading all publishers cluster-wide.
- CVE-2026-67232High
RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 enables permessage-deflate WebSocket compression (RFC 7692) without a max_frame_size limit and without an output-size limit on decompression. An unauthenticated attacker can send a highly compressed WebSocket frame (a zlib bomb) that inflates to gigabytes in memory, crashing a RabbitMQ node running the Web-MQTT plugin.
- CVE-2026-67229Medium
RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 calls rabbit_data_coercion:atomize_keys/1 (the unsafe binary_to_atom variant) on the vhost metadata map. An administrator importing a crafted definitions file can exhaust the atom table and crash the node in a single request.
- CVE-2026-67228Medium
RabbitMQ prior to versions 4.2.7 and 4.3.1 coerces the URL :component segment to an atom via rabbit_data_coercion:to_atom/1 in the runtime-parameters lookup path, creating a new atom for any previously unseen value. An authorized policymaker can send roughly one million requests with distinct component values to exhaust the atom table and crash the node.
- CVE-2026-67221Medium
RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0: the AMQP 0-9-1 shovel removes credentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET /api/shovels and rabbitmqctl shovel_status.
- CVE-2026-67220Medium
RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0: when a binding is created on an x-jms-topic exchange, add_binding/3 reads the rjms_erlang_selector argument and passes it through erl_scan:string/1 and erl_parse:parse_term/1. erl_scan:string/1 interns every atom literal, validate_binding/2 is a no-op with no length cap. An authenticated low-privilege AMQP user can crash the entire broker node in fewer than 100 bind calls.
- CVE-2026-67219Medium
RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0: add_binding/3 parses the routing key as an integer weight N and computes ring positions with lists:seq(NextN0, NextN0 + N - 1). validate_binding/2 only checks N >= 1 with no upper bound. A user with write permission on a consistent-hash exchange can create a binding with a huge weight, allocating hundreds of megabytes on every cluster node.
- CVE-2026-67218Low
In RabbitMQ prior to versions 4.0.22, 4.1.11, 4.2.6, and 4.3.0, the HTTP handler accept_content/2 calls create_super_stream without the required configure permission check on the exchange and partition queues that is present in the stream-protocol path. A user with the management tag and vhost access but no configure permission can create super-streams via the HTTP API.
Original NVD description (English source)
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The trace consumer constructs the output path as filename:join(TraceDir, Name ++ ".log") where Name comes from PUT /api/traces/:vhost/:name. No safe_relative_path / traversal check is applied on the write side, while the read side (rabbit_tracing_files.erl) does call rabbit_misc:safe_relative_path/1 , proving the omission is an oversight, not design. The .log suffix is forced and the endpoint requires administrator. A user with the administrator tag can write a .log-suffixed file to an arbitrary filesystem path writable by the rabbitmq user via the tracing plugin's name parameter, e.g. /etc/cron.d/x.log (if writable) or overwrite existing .log files outside the trace directory. Preconditions include rabbitmq_tracing plugin enabled administrator tag Target path writable by rabbitmq OS user. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.