CVE-2026-67420
published 2026-09-25CVE-2026-67420: RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains revoked…
PriorityP337medium6.5CVSS 3.1
AVNACLPRLUINSUCNIHAN
EPSS
0.23%
13.5th percentile
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains revoked runtime tags. when an existing AMQP connection refreshes from an OAuth token that grants the impersonator tag to a valid same-username token that no longer grants that tag, RabbitMQ updates the OAuth backend implementation (token/scopes/expiry) but leaves the connection's runtime #user.tags unchanged. rabbitaccesscontrol:checkuserid/2 then still honors the stale impersonator tag, so the connection (including newly opened channels) can continue publishing messages with a foreign AMQP userid after that privilege should have been revoked. A fresh connection using the downgraded token correctly refuses the same publish, proving the defect is stale session state rather than the token Limited to connections that once held impersonator and successfully refresh to a downgraded same-username rabbitauthbackendoauth2 (or an equivalent refresh-capable backend that returns tags) is enabled for This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| broadcom | rabbitmq_server | >= 3.13.0 < 3.13.19 | 3.13.19 |
| broadcom | rabbitmq_server | >= 4.0.0 < 4.0.24 | 4.0.24 |
| broadcom | rabbitmq_server | >= 4.1.0 < 4.1.15 | 4.1.15 |
| broadcom | rabbitmq_server | >= 4.2.0 < 4.2.10 | 4.2.10 |
| broadcom | rabbitmq_server | >= 4.3.0 < 4.3.5 | 4.3.5 |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
nvdv4.02.3LOWCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat2.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-67420 rabbitmq-server: rabbitmq-server: Unauthorized user impersonation via stale OAuth token refresh [fedora-all]
bugzilla·2026-09-30·CVSS 2.3
CVE-2026-67420 [LOW] CVE-2026-67420 rabbitmq-server: rabbitmq-server: Unauthorized user impersonation via stale OAuth token refresh [fedora-all]
CVE-2026-67420 rabbitmq-server: rabbitmq-server: Unauthorized user impersonation via stale OAuth token refresh [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains revoked runtime tags. when an existing AMQP connection refreshes from an OAuth token that grants the impersonator tag to a valid same-username token that no longer grants that tag, RabbitMQ updates the OAuth backend implementation (token/scopes/expiry) but leaves the connection's runtime #user.tags
Bugzilla
CVE-2026-67420 rabbitmq-server: rabbitmq-server: Unauthorized user impersonation via stale OAuth token refresh
bugzilla·2026-09-25·CVSS 2.3
CVE-2026-67420 [LOW] CVE-2026-67420 rabbitmq-server: rabbitmq-server: Unauthorized user impersonation via stale OAuth token refresh
CVE-2026-67420 rabbitmq-server: rabbitmq-server: Unauthorized user impersonation via stale OAuth token refresh
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains revoked runtime tags. when an existing AMQP connection refreshes from an OAuth token that grants the impersonator tag to a valid same-username token that no longer grants that tag, RabbitMQ updates the OAuth backend implementation (token/scopes/expiry) but leaves the connection's runtime #user.tags unchanged. rabbitaccesscontrol:checkuserid/2 then still honors the stale impersonator tag, so the connection (including newly opened channels) can continue publishing messages with a foreign AMQP userid after that privilege should have be
https://github.com/rabbitmq/rabbitmq-server/commit/5de287d213765ca592ff5848ad2f6b9b98ee6772https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.5https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-86fm-44m9-rqjxhttps://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-86fm-44m9-rqjx
2026-09-25
Published