Rabbitmq server: RabbitMQ is a messaging and streaming broker. (CVE-2026-66069)
Description
CVE-2026-66069 affects RabbitMQ server versions prior to 4.1.13, 4.2.7, and 4.3.0. It allows a user with a monitoring tag to reset per-node authentication-attempt counters via a DELETE request to /api/auth/attempts/:node, erasing evidence of brute-force attempts. This operation is inconsistent with the analogous reset operation which requires administrator privileges. The impact is cosmetic, affecting only counters without erasing logs. The vulnerability requires the Management plugin to be enabled and is fixed in the specified versions.
CVSS v4.0
Affected software
pkg:deb/ubuntu/rabbitmq-server?arch=source&distro=esm-infra-legacy/xenialpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=esm-infra/bionicpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=esm-infra/focalpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=jammypkg:deb/ubuntu/rabbitmq-server?arch=source&distro=noblepkg:deb/ubuntu/rabbitmq-server?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
RabbitMQ server prior to versions 4.1.13, 4.2.7, and 4.3.0 contains a vulnerability where the is_authorized/2 function uses is_authorized_monitor for all methods, allowing a monitoring-tagged user to reset authentication attempt counters via DELETE /api/auth/attempts/:node. This reset affects only the counters and does not erase logs, but it allows erasure of evidence of brute-force activity. The analogous endpoint wm_reset requires administrator privileges, indicating an inconsistency in authorization checks. The vulnerability requires the Management plugin to be enabled and is fixed in versions 4.1.13, 4.2.7, and 4.3.0.
Potential Impact
The vulnerability allows a monitoring-tagged user to reset authentication attempt counters on a per-node basis, which can erase evidence of brute-force authentication attempts. This impact is cosmetic as it affects only counters and does not erase logs or other data. It could hinder detection and investigation of brute-force attacks but does not directly compromise system integrity or data confidentiality.
Mitigation Recommendations
This issue is fixed in RabbitMQ versions 4.1.13, 4.2.7, and 4.3.0. Users should upgrade to one of these versions or later to remediate the vulnerability. The Management plugin must be enabled for the vulnerability to be exploitable. No other specific mitigations are indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-66069
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.04:LTS"]
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad3f5b12cdf04f656662828
Added to database: 10/17/2026, 22:24:49 UTC
Last enriched: 10/18/2026, 00:10:02 UTC
Last updated: 10/18/2026, 00:10:02 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.