CVE-2026-67233

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The shovel management resource's is_authorized/2 delegates to rabbit_mgmt_util:is_authorized_monitor/2, which accepts the monitoring tag. But allowed_methods includes DELETE, and delete_resource/2 deletes / restarts shovel runtime parameters with no additional role check. A monitoring user , intended to have read-only visibility , can therefore delete or restart any shovel in any vhost they can see. A read-only monitoring user can delete or restart any dynamic shovel , a state-changing operation that the equivalent /api/parameters endpoint correctly restricts to policymaker. Preconditions include rabbitmq_shovel + rabbitmq_shovel_management plugins enabled Attacker has credentials with the monitoring tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.

• CWE-862

• https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6
• https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1
• https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-7jc3-73v6-rjvc

Published

Sep 24, 2026

Last Modified

Sep 25, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-67227RabbitMQ is a messaging and streaming broker. From 4.0.0 unt…5.9
• CVE-2026-67228RabbitMQ is a messaging and streaming broker. Prior to versi…6.9
• CVE-2026-67229RabbitMQ is a messaging and streaming broker. Prior to versi…6.9
• CVE-2026-67230RabbitMQ is a messaging and streaming broker. From 3.13.0 un…6.3
• CVE-2026-67231RabbitMQ is a messaging and streaming broker. Prior to versi…9.1
• CVE-2026-67232RabbitMQ is a messaging and streaming broker. Prior to versi…8.2
• CVE-2026-67234RabbitMQ is a messaging and streaming broker. From 4.2.0 unt…2.3
• CVE-2026-67235RabbitMQ is a messaging and streaming broker. Prior to versi…7.1
• CVE-2026-67236RabbitMQ is a messaging and streaming broker. From 4.2.0 unt…8.2
• CVE-2026-67237RabbitMQ is a messaging and streaming broker. From 4.2.0 unt…7.5
• CVE-2026-67238RabbitMQ is a messaging and streaming broker. Prior to versi…7.1
• CVE-2026-67239RabbitMQ is a messaging and streaming broker. From 3.13.0 un…7.6