CVE-2026-67420

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-67420

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67420.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-67420

Aliases

GHSA-86fm-44m9-rqjx

Downstream

Published

2026-09-25T16:42:49Z

Modified

2026-09-27T03:47:29Z

Severity

2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

RabbitMQ OAuth credential refresh retains revoked runtime tags

Details

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains revoked runtime tags. when an existing AMQP connection refreshes from an OAuth token that grants the impersonator tag to a valid same-username token that no longer grants that tag, RabbitMQ updates the OAuth backend implementation (token/scopes/expiry) but leaves the connection's runtime #user.tags unchanged. rabbitaccesscontrol:checkuserid/2 then still honors the stale impersonator tag, so the connection (including newly opened channels) can continue publishing messages with a foreign AMQP userid after that privilege should have been revoked. A fresh connection using the downgraded token correctly refuses the same publish, proving the defect is stale session state rather than the token Limited to connections that once held impersonator and successfully refresh to a downgraded same-username rabbitauthbackendoauth2 (or an equivalent refresh-capable backend that returns tags) is enabled for This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67420.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "3.13.0"
                },
                {
                    "fixed":  "3.13.19"
                },
                {
                    "introduced":  "4.0.0"
                },
                {
                    "fixed":  "4.0.24"
                },
                {
                    "introduced":  "4.1.0"
                },
                {
                    "fixed":  "4.1.15"
                },
                {
                    "introduced":  "4.2.0"
                },
                {
                    "fixed":  "4.2.10"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/rabbitmq/rabbitmq-server

Affected ranges

Type

GIT

Repo

https://github.com/rabbitmq/rabbitmq-server

Events

Introduced

1929eeadf9b2bac12c5434fb56884ef27370580e

Fixed

5de287d213765ca592ff5848ad2f6b9b98ee6772

Fixed

0dde27bfdd1984ff7e157226fd97656854a7f359

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "4.3.0"
        },
        {
            "fixed":  "4.3.5"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v4.*

v4.3.0

v4.3.1

v4.3.2

v4.3.3

v4.3.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67420.json"