CVE-2026-67233 RabbitMQ: Monitoring-tag user can DELETE shovels

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The shovel management resource's isauthorized/2 delegates to rabbitmgmtutil:isauthorizedmonitor/2, which accepts the monitoring tag. But allowedmethods includes DELETE, and deleteresource/2...

CVE-2026-67233

The messaging and streaming broker RabbitMQ is vulnerable to an authorization bypass in versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1 . When both the rabbitmq_shovel and rabbitmq_shovel_management plugins are enabled, a user with a monitoring tag can perform unauthorized state-chang...