CVE-2026-66069: CWE-862: Missing Authorization in rabbitmq rabbitmq-server
RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, is_authorized/2 uses is_authorized_monitor for all methods. DELETE resets rabbit_core_metrics:reset_auth_attempt_metrics(). Impact is cosmetic (counters only, no log erasure), but inconsistent with rabbit_mgmt_wm_reset.erl which requires admin for the analogous operation. A monitoring-tagged user can reset the per-node authentication-attempt counters via DELETE /api/auth/attempts/:node, erasing evidence of brute-force activity. The sibling endpoint wm_reset requires administrator. Preconditions include Management plugin enabled monitoring tag. This issue is fixed in versions 4.1.13, 4.2.7, and 4.3.0.
AI Analysis
Technical Summary
RabbitMQ versions before 4.1.13, 4.2.7, and 4.3.0 have a missing authorization check (CWE-862) in the management plugin's DELETE /api/auth/attempts/:node endpoint. A user with monitoring privileges can reset authentication attempt counters, which erases evidence of brute-force attempts. This is inconsistent with the sibling wm_reset endpoint that requires admin rights. The vulnerability is fixed in the specified versions.
Potential Impact
The vulnerability allows a monitoring-tagged user to reset authentication attempt counters, erasing evidence of brute-force activity on a node. This impact is cosmetic and does not affect logs or system integrity. There is no indication of privilege escalation or direct compromise from this issue.
Mitigation Recommendations
Upgrade rabbitmq-server to version 4.1.13, 4.2.7, or 4.3.0 or later where this authorization issue is fixed. No additional mitigation is required as the fix is official and addresses the missing authorization.
CVE-2026-66069: CWE-862: Missing Authorization in rabbitmq rabbitmq-server
Description
RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, is_authorized/2 uses is_authorized_monitor for all methods. DELETE resets rabbit_core_metrics:reset_auth_attempt_metrics(). Impact is cosmetic (counters only, no log erasure), but inconsistent with rabbit_mgmt_wm_reset.erl which requires admin for the analogous operation. A monitoring-tagged user can reset the per-node authentication-attempt counters via DELETE /api/auth/attempts/:node, erasing evidence of brute-force activity. The sibling endpoint wm_reset requires administrator. Preconditions include Management plugin enabled monitoring tag. This issue is fixed in versions 4.1.13, 4.2.7, and 4.3.0.
CVSS v4.0
Score 2.3low
Affected software
rabbitmq
rabbitmq-server
pkg:github/rabbitmq/rabbitmq-serverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
RabbitMQ versions before 4.1.13, 4.2.7, and 4.3.0 have a missing authorization check (CWE-862) in the management plugin's DELETE /api/auth/attempts/:node endpoint. A user with monitoring privileges can reset authentication attempt counters, which erases evidence of brute-force attempts. This is inconsistent with the sibling wm_reset endpoint that requires admin rights. The vulnerability is fixed in the specified versions.
Potential Impact
The vulnerability allows a monitoring-tagged user to reset authentication attempt counters, erasing evidence of brute-force activity on a node. This impact is cosmetic and does not affect logs or system integrity. There is no indication of privilege escalation or direct compromise from this issue.
Mitigation Recommendations
Upgrade rabbitmq-server to version 4.1.13, 4.2.7, or 4.3.0 or later where this authorization issue is fixed. No additional mitigation is required as the fix is official and addresses the missing authorization.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-23T23:25:28.897Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab43797f7a7c541064a9651
Added to database: 09/23/2026, 20:33:27 UTC
Last enriched: 09/23/2026, 20:48:43 UTC
Last updated: 09/24/2026, 02:16:46 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.