Rabbitmq server: RabbitMQ is a messaging and streaming broker. (CVE-2026-67241)

RabbitMQ versions 4.2.0 through 4.2.8 and 4.3.0 through 4.3.2 contain a permission check bypass in the AMQP 1.0 management exchange.declare operation. Specifically, the code path for declaring exchanges in AMQP 1.0 does not enforce write permission checks on the alternate-exchange argument, unlike the AMQP 0-9-1 path which correctly enforces these checks. This allows a user with only configure permission on an exchange to route that exchange's unroutable messages into an alternate exchange for which they lack write permission. The vulnerability is addressed by adding the missing permission checks in RabbitMQ versions 4.2.9 and 4.3.3.

An attacker with configure permissions on at least one exchange can misuse the alternate-exchange feature to route messages into an exchange they do not have write permission for. This could potentially allow unauthorized message routing manipulation within the messaging infrastructure, violating intended access controls. The vulnerability does not allow privilege escalation beyond the configure permission but bypasses intended write permission restrictions on alternate exchanges.

This issue is fixed in RabbitMQ versions 4.2.9 and 4.3.3. Users should upgrade to at least these versions to remediate the vulnerability. No other mitigation steps are indicated by the vendor advisory.