Is CVE-2026-66069 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66069 being exploited in the wild.

How severe is CVE-2026-66069?

Informational severity, published 23 September 2026.

Which products and versions are affected?

VMware RabbitMQ before 4.1.13, 4.2.7, and 4.3.0.

Is there a fix for CVE-2026-66069?

A patch was published on 2026-09-23: Fixed in versions 4.1.13, 4.2.7, and 4.3.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-66069 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-66069?

Check whether you run VMware RabbitMQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66069: RabbitMQ unauthorized auth-attempt metrics reset

CVE-2026-66069 · Severity: info · Published 2026-09-23

RabbitMQ's management API allows users with monitoring privileges to reset authentication attempt counters without requiring administrator access. This inconsistency permits a monitoring-tagged user to erase forensic evidence of brute-force login attempts, reducing visibility into attack patterns. While the impact is limited to counter visibility (no actual logs are deleted), it undermines security monitoring and audit compliance in deployments relying on these metrics to detect intrusion activity.

Technologies: VMware RabbitMQ. Vendors: VMware.

Quick answers

Is CVE-2026-66069 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66069 being exploited in the wild.
How severe is CVE-2026-66069?: Informational severity, published 23 September 2026.
Which products and versions are affected?: VMware RabbitMQ before 4.1.13, 4.2.7, and 4.3.0.
Is there a fix for CVE-2026-66069?: A patch was published on 2026-09-23: Fixed in versions 4.1.13, 4.2.7, and 4.3.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-66069 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-66069?: Check whether you run VMware RabbitMQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The is_authorized/2 function in RabbitMQ incorrectly uses is_authorized_monitor for all methods on the DELETE /api/auth/attempts/:node endpoint, allowing users with a monitoring tag to call rabbit_core_metrics:reset_auth_attempt_metrics(). The sibling wm_reset endpoint correctly requires administrator privileges for the equivalent operation. This authorization bypass is a privilege escalation flaw affecting the management plugin when enabled; monitoring is a low-privilege tag and should not permit counter manipulation meant for administrators.

Affected products

VMware RabbitMQ before 4.1.13, 4.2.7, and 4.3.0

Timeline

2026-09-23: disclosed
2026-09-23: patched: Fixed in versions 4.1.13, 4.2.7, and 4.3.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.