CVE-2026-66069: RabbitMQ: Monitoring-tag DELETE of auth-attempt metrics

Low severity · published Sep 23, 2026

CVE-2026-66069

RabbitMQ: Monitoring-tag DELETE of auth-attempt metrics

2.3

CVSS

0.4%

EPSS

On KEV

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, is_authorized/2 uses is_authorized_monitor for all methods. DELETE resets rabbit_core_metrics:reset_auth_attempt_metrics(). Impact is cosmetic (counters only, no log erasure), but inconsistent with rabbit_mgmt_wm_reset.erl which requires admin for the analogous operation. A monitoring-tagged user can reset the per-node authentication-attempt counters via DELETE /api/auth/attempts/:node, erasing evidence of brute-force activity. The sibling endpoint wm_reset requires administrator. Preconditions include Management plugin enabled monitoring tag. This issue is fixed in versions 4.1.13, 4.2.7, and 4.3.0.

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 34% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

rabbitmq-server · rabbitmq

>= 4.1.0, < 4.1.13; >= 4.2.0, < 4.2.7 · source: vendor

Affected product

rabbitmq-server