Vulnerability · Published Sep 25, 2026 · Assigned by GitHub_M

CVE-2026-67411RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass

Medium 6.0

In plain English

A medium-severity incorrect authorization in rabbitmq-server from rabbitmq. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.0Medium

Exploit odds (30 days)0.3%top 75.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3, native MQTT and MQTT over WebSocket behind a trusted PROXY Protocol frontend could lose the proxy-derived client address before the MQTT authentication path checked loopback_users, causing the frontend-to-broker address to be treated as loopback. An attacker who can reach the trusted frontend and has valid credentials for a loopback-restricted account can therefore bypass the source-address restriction; the issue does not bypass password authentication. This issue is fixed in versions 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	rabbitmq-server	no fix listed	DEBIAN-CVE-2026-67411
Debian:13	rabbitmq-server	no fix listed	DEBIAN-CVE-2026-67411
Debian:14	rabbitmq-server	4.3.6-1	DEBIAN-CVE-2026-67411
Ubuntu:22.04:LTS	rabbitmq-server	no fix listed	UBUNTU-CVE-2026-67411
Ubuntu:24.04:LTS	rabbitmq-server	no fix listed	UBUNTU-CVE-2026-67411
Ubuntu:26.04:LTS	rabbitmq-server	no fix listed	UBUNTU-CVE-2026-67411
Ubuntu:26.10	rabbitmq-server	no fix listed	UBUNTU-CVE-2026-67411

Affected products (as reported)

Vendor	Product	Versions
rabbitmq	rabbitmq-server	>= 4.3.0, < 4.3.3>= 4.2.0, < 4.2.9>= 4.1.0, < 4.1.14>= 4.0.0, < 4.0.23>= 3.13.0, < 3.13.18

Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-4r6f-9cpw-f6g6 x_refsource_CONFIRM
https://github.com/rabbitmq/rabbitmq-server/commit/a7528314840c4f8dc9904684f9f97ffa7aac6349 x_refsource_MISC
https://github.com/rabbitmq/rabbitmq-server/commit/edbead0eabbd65925d0dc914a22d6a29e155e646 x_refsource_MISC
https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9 x_refsource_MISC
https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3 x_refsource_MISC