Is CVE-2026-67218 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67218 being exploited in the wild.

How severe is CVE-2026-67218?

Informational severity, published 23 September 2026.

Which products and versions are affected?

VMware RabbitMQ Prior to 4.0.22, 4.1.11, 4.2.6, and 4.3.0.

Is there a fix for CVE-2026-67218?

A patch was published on 2026-04-23: Fixed in versions 4.0.22, 4.1.11, 4.2.6, and 4.3.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-67218 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-67218?

Check whether you run VMware RabbitMQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67218: RabbitMQ privilege escalation in HTTP API super stream creation

CVE-2026-67218 · Severity: info · Published 2026-09-23

RabbitMQ is a message broker that manages data queues and streams across distributed systems. Prior to versions 4.0.22, 4.1.11, 4.2.6, and 4.3.0, a user with basic management access to a virtual host can bypass permission checks and create persistent cluster-wide super-streams through the HTTP API, even without configure permissions on individual resources. This allows privilege escalation from read-only visibility to the ability to create durable infrastructure, potentially disrupting messaging workflows.

Technologies: VMware RabbitMQ. Vendors: VMware.

Quick answers

Is CVE-2026-67218 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67218 being exploited in the wild.
How severe is CVE-2026-67218?: Informational severity, published 23 September 2026.
Which products and versions are affected?: VMware RabbitMQ Prior to 4.0.22, 4.1.11, 4.2.6, and 4.3.0.
Is there a fix for CVE-2026-67218?: A patch was published on 2026-04-23: Fixed in versions 4.0.22, 4.1.11, 4.2.6, and 4.3.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67218 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-67218?: Check whether you run VMware RabbitMQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The HTTP API handler for super stream creation (accept_content/2 in rabbit_stream_manager) checks only management tag and vhost access via is_authorized_vhost, whereas the native stream protocol path enforces configure permission on the exchange and each partition queue via rabbit_stream_utils:check_super_stream_management_permitted/4. An authenticated user with management credentials but no resource-level configure permissions can exploit this inconsistency to create super-streams via HTTP. The fix enforces the same configure permission checks in both code paths.

Affected products

VMware RabbitMQ Prior to 4.0.22, 4.1.11, 4.2.6, and 4.3.0

Timeline

2026-09-23: disclosed
2026-04-23: patched: Fixed in versions 4.0.22, 4.1.11, 4.2.6, and 4.3.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.