CVE-2026-67241: rabbitmq server from 4.2.0 (inclusive), before 4.2.9 (exclusive), from 4.3.0 (inclusive), before 4.3.3 (exclusive); +1…

Affected technology

rabbitmq server · from 4.2.0 (inclusive), before 4.2.9 (exclusive)
broadcom

rabbitmq server · from 4.3.0 (inclusive), before 4.3.3 (exclusive)
broadcom

rabbitmq-server · >= 4.2.0, < 4.2.9, >= 4.3.0, < 4.3.3
rabbitmq

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · High privileges required · No user interaction required

What an attacker can do

A missing-check bug rather than intentional A user with only configure on exchange X can route X's unroutable messages into an alternate exchange they have no write permission AMQP 1.0 enabled (default in RabbitMQ 4.x) Attacker has configure on at least one exchange but lacks write on the target. Vendor/CNA’s CVSS 4.0 assessment (base score 4.8/10) rates confidentiality, integrity and availability impact as none.