AZL-105774 CVE-2026-66069 affecting package rabbitmq-server 3.13.7-10

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, isauthorized/2 uses isauthorizedmonitor for all methods. DELETE resets rabbitcoremetrics:resetauthattemptmetrics. Impact is cosmetic counters only, no log erasure, but inconsistent with rabbitmgmtwmreset.erl...

CVE-2026-66069 RabbitMQ: Monitoring-tag DELETE of auth-attempt metrics

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, isauthorized/2 uses isauthorizedmonitor for all methods. DELETE resets rabbitcoremetrics:resetauthattemptmetrics. Impact is cosmetic counters only, no log erasure, but inconsistent with rabbitmgmtwmreset.erl...

CVE-2026-66069

Prior to versions 4.1.13 , 4.2.7 , and 4.3.0 , RabbitMQ is vulnerable to a flaw where the is_authorized/2 function incorrectly uses is_authorized_monitor for all methods. This allows a user with a monitoring tag to call DELETE /api/auth/attempts/:node to reset per-node authentication-attempt coun...