A flaw was found in RabbitMQ. The Federation feature fails to enforce virtual host (vhost) authorization checks when validating upstream connections. An authenticated user with policy configuration privileges in one vhost can exploit this flaw by targeting another vhost where they lack permissions. This allows the user to read and drain (delete) messages from unauthorized vhosts, compromising multi-tenant isolation and leading to unauthorized data disclosure and message loss.
Last checked: 2026-10-08 17:38 UTC
Proof of concept · CISA Coordinator (Assessed 2026-09-25 16:44 UTC)
Exploit reference · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · View external evidence (Observed 2026-10-08 17:38 UTC)
Fix evidence last checked: 2026-10-08 23:45 UTC