CVE-2026-67418
Description
A flaw was found in rabbitmq-server. An authenticated user with message publishing permissions can transmit a specially crafted Message Queuing Telemetry Transport (MQTT) message containing an invalid property. When the broker forwards this message, an unhandled exception terminates the recipient's connection, leading to a targeted Denial of Service (DoS) for affected subscribers.
Statement
This vulnerability is rated as Moderate impact because triggering the issue requires valid client authentication with topic write permissions, and the failure is limited to terminating matching subscriber sessions without affecting broker availability or data integrity. In standard Red Hat environments, such as Red Hat OpenStack Platform, RabbitMQ operates primarily over AMQP, and MQTT support is provided through optional plugins that are disabled by default. Consequently, exposure is confined to deployments where administrators have explicitly enabled MQTT plugins and untrusted users possess publishing privileges.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.3 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | Low | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
