CVE-2026-67233 RabbitMQ: Monitoring-tag user can DELETE shovels

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The shovel management resource's isauthorized/2 delegates to rabbitmgmtutil:isauthorizedmonitor/2, which accepts the monitoring tag. But allowedmethods includes DELETE, and deleteresource/2...

CVE-2026-67233

RabbitMQ messaging and streaming broker contains an improper authorization vulnerability in the shovel management resource prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1. The is_authorized/2 function delegates to rabbit_mgmt_util:is_authorized_monitor/2, which incorrectly accepts the...