Skip to content
Heist/ feed
Low

RabbitMQ OAuth credential refresh retains revoked runtime tags

Type: advisorySource: Official CVE List1 source record

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains revoked runtime tags. when an existing AMQP connection refreshes from an OAuth token that grants the impersonator tag to a valid same-username token that no longer grants that tag, RabbitMQ updates the OAuth backend implementation (token/scopes/expiry) but leaves the connection's runtime #user.tags unchanged. rabbitaccesscontrol:checkuserid/2 then still honors the stale impersonator tag, so the connection (including newly opened channels) can continue publishing messages with a foreign AMQP userid after that privilege should have been revoked. A fresh connection using the downgraded token correctly refuses the same publish, proving the defect is stale session state rather than the token Limited to connections that once held impersonator and successfully refresh to a downgraded same-username rabbitauthbackendoauth2 (or an equivalent refresh-capable backend that returns tags) is enabled for This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.

Announced Source revision 1
Original source ↗

CVE-2026-67420

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-67420

rabbitmq-server

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "rabbitmq",
    "product": "rabbitmq-server",
    "versions": [
      {
        "status": "affected",
        "version": ">= 3.13.0, < 3.13.19"
      },
      {
        "status": "affected",
        "version": ">= 4.0.0, < 4.0.24"
      },
      {
        "status": "affected",
        "version": ">= 4.1.0, < 4.1.15"
      },
      {
        "status": "affected",
        "version": ">= 4.2.0, < 4.2.10"
      },
      {
        "status": "affected",
        "version": ">= 4.3.0, < 4.3.5"
      }
    ]
  }
]
Related CVEs
CVE-2026-67420

Source reference: /cveMetadata/cveId

Publisher severity

low

Source reference: /containers/cna/metrics

Event
#3983 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement