CVE-2026-66078

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, protected tag bypass via bulk-delete. dELETE /api/users/:name refuses to delete users tagged protected rabbitmgmtwmuser:deleteresource/2 checks isprotecteduser. POST /api/users/bulk-delete...

UBUNTU-CVE-2026-66078

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, protected tag bypass via bulk-delete. dELETE /api/users/:name refuses to delete users tagged protected rabbitmgmtwmuser:deleteresource/2 checks isprotecteduser. POST /api/users/bulk-delete...

CVE-2026-66078 RabbitMQ: protected tag bypass via bulk-delete

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, protected tag bypass via bulk-delete. dELETE /api/users/:name refuses to delete users tagged protected rabbitmgmtwmuser:deleteresource/2 checks isprotecteduser. POST /api/users/bulk-delete...

CVE-2026-66078 RabbitMQ: protected tag bypass via bulk-delete

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, protected tag bypass via bulk-delete. dELETE /api/users/:name refuses to delete users tagged protected rabbitmgmtwmuser:deleteresource/2 checks isprotecteduser. POST /api/users/bulk-delete...

EUVD-2026-87150

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, protected tag bypass via bulk-delete. dELETE /api/users/:name refuses to delete users tagged protected rabbitmgmtwmuser:deleteresource/2 checks isprotecteduser. POST /api/users/bulk-delete...

CVE-2026-66078

The messaging and streaming broker RabbitMQ is vulnerable to a protected tag bypass via the bulk-delete endpoint. In versions 3.13.0 through 3.13.14 , 4.0.20 through 4.1.10 , and 4.2.6 , the POST /api/users/bulk-delete endpoint fails to verify protected tags, unlike the DELETE /api/users/:name en...

CVE-2026-66078 RabbitMQ: protected tag bypass via bulk-delete

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, protected tag bypass via bulk-delete. dELETE /api/users/:name refuses to delete users tagged protected rabbitmgmtwmuser:deleteresource/2 checks isprotecteduser. POST /api/users/bulk-delete...

CVE-2026-97228

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component getexportstatus in src/exportmanager.py, whereby the exportid value — an unvalidated MCP tool argument reaching the function via the checkrapid7exportstatus and...

EUVD-2026-86930

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component getexportstatus in src/exportmanager.py, whereby the exportid value — an unvalidated MCP tool argument reaching the function via the checkrapid7exportstatus and...

CVE-2026-97228 Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status Lookup

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component getexportstatus in src/exportmanager.py, whereby the exportid value — an unvalidated MCP tool argument reaching the function via the checkrapid7exportstatus and...

CVE-2026-97228

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 are vulnerable to a GraphQL query injection in the export-status component. Specifically, the get_export_status function in src/export_manager.py fails to validate the export_id argument, which is received via the check_rapid7_export_status and ...

CVE-2026-97228 Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status Lookup

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component getexportstatus in src/exportmanager.py, whereby the exportid value — an unvalidated MCP tool argument reaching the function via the checkrapid7exportstatus and...

CVE-2026-97228 Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status Lookup

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component getexportstatus in src/exportmanager.py, whereby the exportid value — an unvalidated MCP tool argument reaching the function via the checkrapid7exportstatus and...

CVE-2026-93477

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths. Action arguments declared with public?: false are meant to be set only by trusted...

CVE-2026-93477 Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths. Action arguments declared with public?: false are meant to be set only by trusted...

EUVD-2026-86550

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths. Action arguments declared with public?: false are meant to be set only by trusted...

CVE-2026-93477 Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths. Action arguments declared with public?: false are meant to be set only by trusted...

CVE-2026-93477

The ash-project ash framework is vulnerable to an Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability. In versions 2.17.15 before 3.33.11 , the Ash.Actions.Destroy.Bulk.base_changeset/5 and Ash.Actions.Update.Bulk.base_changeset/5 functions fail to verify ...

CVE-2026-93477 Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths. Action arguments declared with public?: false are meant to be set only by trusted...

PT-2026-98903

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.14 RabbitMQ versions 4.0.x prior to 4.0.20 RabbitMQ versions 4.1.x prior to 4.1.11 RabbitMQ versions 4.2.x prior to 4.2.6 Description A protected tag bypass exists when the rabbitmqmanagement plugin is...