CVE-2026-67411: CWE-863: Incorrect Authorization in rabbitmq rabbitmq-server
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3, native MQTT and MQTT over WebSocket behind a trusted PROXY Protocol frontend could lose the proxy-derived client address before the MQTT authentication path checked loopback_users, causing the frontend-to-broker address to be treated as loopback. An attacker who can reach the trusted frontend and has valid credentials for a loopback-restricted account can therefore bypass the source-address restriction; the issue does not bypass password authentication. This issue is fixed in versions 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3.
AI Analysis
Technical Summary
RabbitMQ versions 3.13.0 through 3.13.17, 4.0.0 through 4.0.22, 4.1.0 through 4.1.13, 4.2.0 through 4.2.8, and 4.3.0 through 4.3.2 have an incorrect authorization vulnerability (CWE-863) in their native MQTT and MQTT over WebSocket implementations when deployed behind a trusted PROXY Protocol frontend. The proxy-derived client address can be lost before the MQTT authentication path checks loopback_users, causing the frontend-to-broker address to be treated as loopback. This allows an attacker who can access the trusted frontend and has valid credentials for a loopback-restricted account to bypass source-address restrictions, though password authentication is still enforced. The issue is fixed in versions 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3.
Potential Impact
An attacker with valid credentials for a loopback-restricted account and access to the trusted PROXY Protocol frontend can bypass source-address restrictions intended to limit access to loopback addresses. This could allow unauthorized access to resources restricted by source address, but does not bypass password authentication. The vulnerability has a medium severity with a CVSS 4.0 score of 6.0.
Mitigation Recommendations
This vulnerability is fixed in rabbitmq-server versions 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3. Users should upgrade to these or later versions to remediate the issue. No other mitigation is indicated by the vendor advisory.
CVE-2026-67411: CWE-863: Incorrect Authorization in rabbitmq rabbitmq-server
Description
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3, native MQTT and MQTT over WebSocket behind a trusted PROXY Protocol frontend could lose the proxy-derived client address before the MQTT authentication path checked loopback_users, causing the frontend-to-broker address to be treated as loopback. An attacker who can reach the trusted frontend and has valid credentials for a loopback-restricted account can therefore bypass the source-address restriction; the issue does not bypass password authentication. This issue is fixed in versions 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3.
CVSS v4.0
Score 6.0medium
Affected software
rabbitmq
rabbitmq-server
pkg:github/rabbitmq/rabbitmq-serverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
RabbitMQ versions 3.13.0 through 3.13.17, 4.0.0 through 4.0.22, 4.1.0 through 4.1.13, 4.2.0 through 4.2.8, and 4.3.0 through 4.3.2 have an incorrect authorization vulnerability (CWE-863) in their native MQTT and MQTT over WebSocket implementations when deployed behind a trusted PROXY Protocol frontend. The proxy-derived client address can be lost before the MQTT authentication path checks loopback_users, causing the frontend-to-broker address to be treated as loopback. This allows an attacker who can access the trusted frontend and has valid credentials for a loopback-restricted account to bypass source-address restrictions, though password authentication is still enforced. The issue is fixed in versions 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3.
Potential Impact
An attacker with valid credentials for a loopback-restricted account and access to the trusted PROXY Protocol frontend can bypass source-address restrictions intended to limit access to loopback addresses. This could allow unauthorized access to resources restricted by source address, but does not bypass password authentication. The vulnerability has a medium severity with a CVSS 4.0 score of 6.0.
Mitigation Recommendations
This vulnerability is fixed in rabbitmq-server versions 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3. Users should upgrade to these or later versions to remediate the issue. No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-29T15:02:20.412Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab6a5d5f7a7c54106055644
Added to database: 09/25/2026, 16:48:21 UTC
Last enriched: 09/25/2026, 17:03:24 UTC
Last updated: 09/26/2026, 02:45:13 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.