RabbitMQ: Monitoring-tag DELETE of auth-attempt metrics
Published Sep 23, 2026
2.3
LOWCVSS 4.0
EPSS 0.40%
Description
RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, is_authorized/2 uses is_authorized_monitor for all methods. DELETE resets rabbit_core_metrics:reset_auth_attempt_metrics(). Impact is cosmetic (counters only, no log erasure), but inconsistent with rabbit_mgmt_wm_reset.erl which requires admin for the analogous operation. A monitoring-tagged user can reset the per-node authentication-attempt counters via DELETE /api/auth/attempts/:node, erasing evidence of brute-force activity. The sibling endpoint wm_reset requires administrator. Preconditions include Management plugin enabled monitoring tag. This issue is fixed in versions 4.1.13, 4.2.7, and 4.3.0.
Affected products
-
- Version >= 4.1.0, < 4.1.13StatusaffectedConstraints-
- Version >= 4.2.0, < 4.2.7StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Rabbitmq | Rabbitmq-Server | n/a |
|
No data.
No data.
Red Hat Hardened Images
rabbitmq-server4-3-main-4.3.6-1.hum1
Fixed · RHSA-2026:67552
Red Hat Hardened Images
rabbitmq-server4.2
Will not fix
Red Hat OpenStack Platform 13 (Queens)
rabbitmq-server
Not affected
Red Hat OpenStack Platform 16.2
rabbitmq-server
Not affected
Red Hat OpenStack Platform 17.1
rabbitmq-server
Not affected
Red Hat OpenStack Platform 18.0
rabbitmq-server
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Hardened Images | rabbitmq-server4-3-main-4.3.6-1.hum1 | Fixed | RHSA-2026:67552 |
| Red Hat Hardened Images | rabbitmq-server4.2 | Will not fix | n/a |
| Red Hat OpenStack Platform 13 (Queens) | rabbitmq-server | Not affected | n/a |
| Red Hat OpenStack Platform 16.2 | rabbitmq-server | Not affected | n/a |
| Red Hat OpenStack Platform 17.1 | rabbitmq-server | Not affected | n/a |
| Red Hat OpenStack Platform 18.0 | rabbitmq-server | Fix deferred | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
Red Hat rates this flaw MODERATE in products that ship affected RabbitMQ builds. A monitoring-tagged user can reset authentication-attempt counters through the Management API without administrator permission. Broker logs remain intact, so the impact is limited to tampering with security metrics.
Red Hat mitigation
Restrict Management API access and monitoring-tag accounts, or disable the Management plugin where it is not needed.
References (8)
- https://access.redhat.com/security/cve/CVE-2026-66069 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2539756 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-85632 Advisory
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7 x_refsource_MISC
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0 x_refsource_MISC
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-fhwq-9rvh-prj2 x_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2026-66069
- https://www.cve.org/CVERecord?id=CVE-2026-66069
Change history (0)
No recorded changes yet.