Between 23 and 25 September 2026, NVD published 54 CVEs for RabbitMQ server, and three more followed on 14 October. An NVD keyword search for "rabbitmq" over 1 September to 18 October returns 57 records that start with "RabbitMQ is a messaging and streaming broker". They cover the management API and UI, OAuth2, shovel and federation, MQTT, Web-STOMP, the stream protocol and the AMQP 1.0 parser.
The fixes are older than the CVE records. The GitHub advisories we checked were published between 9 July and 18 August, and many say the issue was found by Team RabbitMQ or other teams at Broadcom. Open source RabbitMQ 4.3.6, released 14 September, already contains every fix below.
What's affected
Fixed versions differ per CVE. On the 4.3 line they range from 4.3.0 to 4.3.5, so 4.3.6 covers all of them.
The older lines are the catch. RabbitMQ's release information page lists 4.3 as the only series with community support. Community support for 4.2 ended on 31 July 2026, and 4.1, 4.0 and 3.13 are commercial only. The last public GitHub release on 4.2 is 4.2.9, so fixed versions such as 4.2.10, 4.1.15 and 3.13.19 come through commercial support. On open source 4.2 or older, the practical fix is 4.3.6.
The ones that matter most, grouped by what an attacker has to reach:
| CVE | Reachable via | Login needed | Condition | Fixed in |
|---|---|---|---|---|
| CVE-2026-66079 | AMQP 1.0, port 5672 | No | One ~19 byte frame crashes the node | 4.2.6, 4.1.11, 3.13.15 |
| CVE-2026-67232 | Web-MQTT, port 15675 | No | Compressed WebSocket frame inflates to gigabytes | 4.3.0, 4.2.6 |
| CVE-2026-67230 | Web-STOMP, port 15674 | No | Unbounded pre-auth state | 4.2.6 |
| CVE-2026-67225 | Stream, port 5552 | No | Frame length not checked against frame_max | 4.2.6 |
| CVE-2026-67410 | Management, port 15672 | No | OAuth2 UI with a client secret; secret served in bootstrap.js | 4.3.3, 4.2.9 |
| CVE-2026-67231 | Any TLS listener | No | Trust store plugin accepts forged cert with known issuer and serial | 4.3.0, 4.2.6 |
| CVE-2026-67404 | Any OAuth2 listener | No, needs MITM | No CA bundle, so JWKS fetched unverified | 4.3.0, 4.2.6 |
| CVE-2026-67242 | Any OAuth2 listener | Expired token | IdP issues exp as a float; expiry never checked | 4.3.3, 4.2.9 |
| CVE-2026-67238 | AMQP, port 5672 | Any user | Reply-to names exhaust the atom table | 4.3.1, 4.2.7 |
| CVE-2026-67414 | AMQP 1.0, port 5672 | Any user | Small frame expands into gigabytes of heap | 4.3.4, 4.2.10 |
| CVE-2026-67418 | MQTT 1883/8883, Web-MQTT | Publisher | MQTT 5 property disconnects matching subscribers | 4.3.5, 4.2.10 |
| CVE-2026-67239 | Management UI | Trusted client cert | Stored XSS from certificate DN on stream pages | 4.3.3, 4.2.9 |
The authenticated tier is bigger than the table. A user with only the monitoring tag can reset auth attempt counters (CVE-2026-66069), restart federation links (CVE-2026-66075) and delete shovels (CVE-2026-67233). A policymaker can drain another vhost through a federation upstream (CVE-2026-67412).
The sources don't always agree. NVD's record for CVE-2026-67223, an LDAP bind DN injection, notes that the advisory gives conflicting first fixed versions for 3.13, 4.0 and 4.1. The GitHub advisory for CVE-2026-66079 doesn't list 4.3 as affected at all. When in doubt, go by the advisory and the release notes.
How to check if you're exposed
Start with the version and enabled plugins on each node:
rabbitmq-diagnostics server_version
rabbitmq-plugins list -E
rabbitmq-diagnostics listeners
The listener list tells you which table rows apply. Then look for the settings that make conditional bugs real:
grep -nE "oauth_client_secret|oauth_enabled|cors_allow_origins|trust_store|auth_backends|verify_peer" /etc/rabbitmq/rabbitmq.conf
If OAuth2 is on for the management UI, test the secret leak from a machine that can reach port 15672:
curl -s http://rabbit.example.internal:15672/js/oidc-oauth/bootstrap.js | grep -i secret
For containers, list the image tags you actually run:
kubectl get pods -A -o jsonpath='{..image}' | tr ' ' '\n' | grep -i rabbitmq | sort -u
What to do now
- Upgrade to 4.3.6. Read the 4.3.0 release notes first if you are coming from 4.2, and note that 4.3.3 raised the minimum Erlang version to 27.0.
- On commercial 4.2, 4.1, 4.0 or 3.13, get the latest patch for your line and check each CVE's fixed version.
- Rotate the OAuth2 client secret if CVE-2026-67410 applied. Anyone who could reach the management port could read it.
- Close unused listeners. Every pre-auth bug in the table needs Web-MQTT, Web-STOMP, stream or AMQP 1.0 to be reachable.
- Keep port 15672 off untrusted networks, and replace
cors_allow_origins = *with explicit origins. - Set a CA bundle for the OAuth2 plugin so the JWKS fetch is verified.
Why it matters
A batch of 57 CVEs looks like a fire. Sorted by reachability, it is a short list: four pre-auth crashes that matter only if a listener is exposed, a few OAuth2 and TLS bugs that depend on configuration, and a long tail that needs an account with a specific tag.
The bigger problem is version lag. These fixes shipped in July and August, but tools keyed on NVD only started flagging them in late September. Teams on community 4.2 or 4.1 have no free patch to move to, only a jump to 4.3.
Try it yourself
Fill in the table for one RabbitMQ deployment: version, enabled plugins, open listeners, auth backend. Count how many of the 57 CVEs survive. The demo shows the same exercise on a real finding, checking whether a vulnerable path is reachable before you rank it.
Click through it at your own pace, or open it full screen.
Quick check
We run open source RabbitMQ 4.2.9. Are we covered?
No. CVE-2026-67414 and CVE-2026-67418 are fixed only in 4.2.10 or later, and those builds are not public GitHub releases. Move to 4.3.6.
Does CVE-2026-67410 affect us if the management UI uses internal users?
No. It needs OAuth2 enabled for the management UI with a flow that uses a client secret.
Which bugs work with no credentials at all?
The crashes on AMQP 1.0, Web-MQTT, Web-STOMP and stream, plus the OAuth2 client secret leak. Each needs the matching listener or plugin to be reachable.
Sources
- NVD API keyword search, RabbitMQ, 1 Sep to 18 Oct 2026
- RabbitMQ release information
- RabbitMQ 4.3.6 release notes
- RabbitMQ 4.3.3 release notes
- GHSA-c66h-hf5j-8jf9 (CVE-2026-66079)
- GHSA-gmgx-hhg5-43gr (CVE-2026-67232)
- GHSA-f9f2-q3jf-wfj3 (CVE-2026-67410)
- GHSA-rrj4-g94f-rqj9 (CVE-2026-67242)
- GHSA-cw8c-4m83-9c6w (CVE-2026-67231)
- GHSA-jv99-v328-mvmm (CVE-2026-67418)
- GHSA-w6mq-4qpx-v7mh (CVE-2026-67414)
- NVD: CVE-2026-67223
