# RabbitMQ vulnerabilities Source: https://junglewise.ai/threats/technologies/rabbitmq-rabbitmq Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/rabbitmq-rabbitmq.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 24 vulnerabilities in RabbitMQ: 0 in the last 7 days and 24 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-67420, was published on 25 September 2026. Nothing in the last four weeks, down from 24 vulnerabilities in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 24 - All time: 24 (0 critical, 0 exploited in the wild) ## About RabbitMQ Open-source message broker implementing AMQP protocol for distributed systems. ## Latest RabbitMQ vulnerabilities - [CVE-2026-67420: RabbitMQ OAuth privilege escalation via stale token tags](https://junglewise.ai/threats/cve-2026-67420-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-3) (info, published 25 Sep 2026) - [CVE-2026-67419: RabbitMQ topic exchange denial of service via duplicate matchers](https://junglewise.ai/threats/cve-2026-67419-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-4-3-5-an) (info, published 25 Sep 2026) - [CVE-2026-67415: RabbitMQ Shovel denial of service via atom exhaustion](https://junglewise.ai/threats/cve-2026-67415-rabbitmq-is-a-messaging-and-streaming-broker-from-4-2-0-until-4-2) (info, published 25 Sep 2026) - [CVE-2026-67411: RabbitMQ MQTT loopback user bypass via PROXY Protocol](https://junglewise.ai/threats/cve-2026-67411-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-3) (info, published 25 Sep 2026) - [CVE-2026-67410: RabbitMQ OAuth2 client secret exposure via unauthenticated endpoint](https://junglewise.ai/threats/cve-2026-67410-rabbitmq-is-a-messaging-and-streaming-broker-from-4-2-0-until-4-3) (info, published 25 Sep 2026) - [CVE-2026-67409: RabbitMQ JWKS fetch ignores HTTP response status code](https://junglewise.ai/threats/cve-2026-67409-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-4) (info, published 25 Sep 2026) - [CVE-2026-67406: RabbitMQ Shovel credentials exposure in crash dumps](https://junglewise.ai/threats/cve-2026-67406-rabbitmq-is-a-messaging-and-streaming-broker-from-4-0-0-until-4-3) (info, published 25 Sep 2026) - [CVE-2026-67241: RabbitMQ AMQP 1.0 alternate-exchange permission bypass](https://junglewise.ai/threats/cve-2026-67241-rabbitmq-is-a-messaging-and-streaming-broker-from-4-2-0-until-4-2) (info, published 25 Sep 2026) - [CVE-2026-67239: RabbitMQ stored XSS in stream-management UI via TLS peer-certificate DN](https://junglewise.ai/threats/cve-2026-67239-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-3) (info, published 25 Sep 2026) - [CVE-2026-67237: RabbitMQ reflected XSS in OAuth bootstrap management UI](https://junglewise.ai/threats/cve-2026-67237-rabbitmq-is-a-messaging-and-streaming-broker-from-4-2-0-until-4-2) (info, published 25 Sep 2026) - [CVE-2026-67234: RabbitMQ non-RFC-conformant cookie name in auth mechanism](https://junglewise.ai/threats/cve-2026-67234-rabbitmq-is-a-messaging-and-streaming-broker-from-4-2-0-until-4-2) (info, published 25 Sep 2026) - [CVE-2026-67230: RabbitMQ Web STOMP WebSocket denial of service](https://junglewise.ai/threats/cve-2026-67230-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-3) (info, published 25 Sep 2026) - [CVE-2026-67227: RabbitMQ atom exhaustion in global parameters API](https://junglewise.ai/threats/cve-2026-67227-rabbitmq-is-a-messaging-and-streaming-broker-from-4-0-0-until-4-0) (info, published 25 Sep 2026) - [CVE-2026-67223: RabbitMQ LDAP DN injection in auth backend](https://junglewise.ai/threats/cve-2026-67223-rabbitmq-is-a-messaging-and-streaming-broker-the-advisory) (info, published 25 Sep 2026) - [CVE-2026-61837: RabbitMQ AMQP 1.0 management binding enumeration](https://junglewise.ai/threats/cve-2026-61837-rabbitmq-is-a-messaging-and-streaming-broker-from-4-0-0-until-4-3) (info, published 25 Sep 2026) - [CVE-2026-67240: RabbitMQ regex backtracking CPU amplification in stream queue filters](https://junglewise.ai/threats/cve-2026-67240-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-4) (info, published 23 Sep 2026) - [CVE-2026-67232: RabbitMQ zlib bomb denial of service in Web-MQTT WebSocket](https://junglewise.ai/threats/cve-2026-67232-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-3) (info, published 23 Sep 2026) - [CVE-2026-67224: RabbitMQ path traversal in tracing plugin](https://junglewise.ai/threats/cve-2026-67224-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-3) (info, published 23 Sep 2026) - [CVE-2026-66075: RabbitMQ privilege escalation in federation link restart](https://junglewise.ai/threats/cve-2026-66075-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-3) (info, published 23 Sep 2026) - [CVE-2026-66074: RabbitMQ regex denial of service in management API](https://junglewise.ai/threats/cve-2026-66074-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-3) (info, published 23 Sep 2026) - [CVE-2026-66068: RabbitMQ Shovel plaintext credentials in debug logs](https://junglewise.ai/threats/cve-2026-66068-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-3) (info, published 23 Sep 2026) - [CVE-2026-66067: RabbitMQ stream protocol connection limit bypass](https://junglewise.ai/threats/cve-2026-66067-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-4) (info, published 23 Sep 2026) - [CVE-2026-66076: RabbitMQ missing authorization in quorum queue status endpoint](https://junglewise.ai/threats/cve-2026-66076-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-3) (info, published 23 Sep 2026) - [CVE-2026-66070: RabbitMQ management plugin CORS credential theft with wildcard origin](https://junglewise.ai/threats/cve-2026-66070-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-3) (info, published 23 Sep 2026) ## Most severe RabbitMQ vulnerabilities - [CVE-2026-66070: RabbitMQ management plugin CORS credential theft with wildcard origin](https://junglewise.ai/threats/cve-2026-66070-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-3) (info, published 23 Sep 2026) - [CVE-2026-67224: RabbitMQ path traversal in tracing plugin](https://junglewise.ai/threats/cve-2026-67224-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-3) (info, published 23 Sep 2026) - [CVE-2026-67232: RabbitMQ zlib bomb denial of service in Web-MQTT WebSocket](https://junglewise.ai/threats/cve-2026-67232-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-3) (info, published 23 Sep 2026) - [CVE-2026-66067: RabbitMQ stream protocol connection limit bypass](https://junglewise.ai/threats/cve-2026-66067-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-4) (info, published 23 Sep 2026) - [CVE-2026-66074: RabbitMQ regex denial of service in management API](https://junglewise.ai/threats/cve-2026-66074-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-3) (info, published 23 Sep 2026) - [CVE-2026-66076: RabbitMQ missing authorization in quorum queue status endpoint](https://junglewise.ai/threats/cve-2026-66076-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-3) (info, published 23 Sep 2026) - [CVE-2026-67240: RabbitMQ regex backtracking CPU amplification in stream queue filters](https://junglewise.ai/threats/cve-2026-67240-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-4) (info, published 23 Sep 2026) - [CVE-2026-66075: RabbitMQ privilege escalation in federation link restart](https://junglewise.ai/threats/cve-2026-66075-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-3) (info, published 23 Sep 2026) - [CVE-2026-66068: RabbitMQ Shovel plaintext credentials in debug logs](https://junglewise.ai/threats/cve-2026-66068-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-3) (info, published 23 Sep 2026) - [CVE-2026-67420: RabbitMQ OAuth privilege escalation via stale token tags](https://junglewise.ai/threats/cve-2026-67420-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-3) (info, published 25 Sep 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 24 vulnerabilities in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 24 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other RabbitMQ technologies - [RabbitMQ Amqp091-Go](https://junglewise.ai/threats/technologies/amqp091-go): 12 vulnerabilities - [RabbitMQ Amqp-Client](https://junglewise.ai/threats/technologies/amqp-client): 4 vulnerabilities - [RabbitMQ Java client library](https://junglewise.ai/threats/technologies/java-client-library): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "RabbitMQ vulnerabilities", https://junglewise.ai/threats/technologies/rabbitmq-rabbitmq, 9 November 2026.