Search: CVE-2026-67233

CVE-2026-67233 is a missing authorization vulnerability in rabbitmq-server affecting the shovel management resource. Prior to fixed versions, users with the monitoring tag, intended for read-only access, could delete or restart shovels in any vhost they could see. This is due to insufficient role checks on DELETE operations in the shovel management API. The issue requires the rabbitmq_shovel and rabbitmq_shovel_management plugins to be enabled. It is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.