Rabbitmq server: RabbitMQ is a messaging and streaming broker. (CVE-2026-67411)
Description
RabbitMQ versions from 3.13.0 up to but not including 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3 have a vulnerability in their native MQTT and MQTT over WebSocket implementations when used behind a trusted PROXY Protocol frontend. The issue causes the proxy-derived client address to be lost before the MQTT authentication checks loopback_users, allowing the frontend-to-broker address to be treated as loopback. This enables an attacker with valid credentials for a loopback-restricted account to bypass source-address restrictions, though password authentication is still required. The vulnerability is fixed in the specified patched versions.
CVSS v3.1
Score 7.1high
Affected software
pkg:deb/ubuntu/rabbitmq-server?arch=source&distro=esm-infra-legacy/xenialpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=esm-infra/bionicpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=esm-infra/focalpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=jammypkg:deb/ubuntu/rabbitmq-server?arch=source&distro=noblepkg:deb/ubuntu/rabbitmq-server?arch=source&distro=stonkingpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-67411 affects RabbitMQ messaging broker versions from 3.13.0 until 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3. When native MQTT and MQTT over WebSocket are deployed behind a trusted PROXY Protocol frontend, the proxy-derived client address can be lost before the authentication path checks loopback_users. This causes the frontend-to-broker address to be treated as loopback, allowing an attacker who can reach the trusted frontend and has valid credentials for a loopback-restricted account to bypass source-address restrictions. Password authentication is not bypassed. The issue is resolved in versions 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3.
Potential Impact
An attacker with valid credentials for a loopback-restricted account who can access the trusted PROXY Protocol frontend can bypass source-address restrictions that normally limit access to loopback addresses. This could allow unauthorized access to resources restricted by source address. However, password authentication is still required, so the vulnerability does not allow bypassing authentication itself.
Mitigation Recommendations
This vulnerability is fixed in RabbitMQ versions 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3. Users should upgrade to these or later versions to remediate the issue. No other mitigation is indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-67411
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad3f5a72cdf04f6566627d7
Added to database: 10/17/2026, 22:24:39 UTC
Last enriched: 10/17/2026, 23:54:49 UTC
Last updated: 10/17/2026, 23:54:49 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.