Rabbitmq server: RabbitMQ is a messaging and streaming broker. (CVE-2026-67420)

The vulnerability in RabbitMQ affects OAuth credential refresh handling when using the rabbitauthbackendoauth2 or equivalent backend that returns tags. When an AMQP connection refreshes its OAuth token from one that granted the impersonator tag to a downgraded token without that tag but with the same username, RabbitMQ updates the token information but does not clear the connection's runtime user tags. Consequently, the connection retains the stale impersonator tag and can continue publishing messages with a foreign AMQP userid despite the privilege being revoked. Fresh connections with the downgraded token correctly reject such actions, confirming the issue is due to stale session state. This flaw is present in RabbitMQ versions from 3.13.0 until fixed in 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.

An attacker with an AMQP connection that previously held the impersonator tag can continue to impersonate other users and publish messages with their identity after the token's impersonator privilege has been revoked, until the connection is closed. This can lead to unauthorized message publishing and potential privilege escalation within RabbitMQ environments using OAuth authentication with token refresh.

This vulnerability is fixed in RabbitMQ versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5. Users should upgrade to these or later versions to remediate the issue. No other mitigation is indicated by the vendor advisory.