CVE-2026-67408

Executive Summary

CVE-2026-67408 is a resource-exhaustion vulnerability in RabbitMQ's Stream Management plugin (rabbitmq_stream_management) that allows an authenticated, low-privileged management user to trigger unbounded transient memory allocation via a single crafted HTTP request. The flaw affects RabbitMQ versions 4.1.0 through 4.3.2 (with fixes in 4.3.3, 4.2.9, and 4.1.11) and requires only vhost access — no configure, write, or read permissions are needed. Successful exploitation crashes or kills the broker process, producing a complete denial of service for all messaging and streaming workloads hosted on the affected node.

Technical Analysis

The vulnerability resides in the Stream Management Super-Stream binding-key allocation logic. RabbitMQ stream super-streams allow a logical grouping of streams, and clients bind to them using one or more binding keys. The management plugin exposes an HTTP API endpoint — PUT /api/stream/super-streams/{vhost}/{name} — that accepts a JSON body containing a binding-keys field.

The root cause is an ordering defect (CWE-400, uncontrolled resource consumption): the handler parses the attacker-controlled, comma-separated binding-keys string and constructs the full list of resulting stream names before verifying that the authenticated user holds the configure, write, or read permissions on those streams. In other words, the expensive allocation step — materializing a potentially enormous list of stream-name objects from a user-supplied string — executes prior to the authorization check that would otherwise reject the request.

Because the parse-and-build phase is unbounded with respect to the input string length, an attacker can craft a binding-keys value that expands into a very large in-memory structure. The NVD description documents that in a 768 MB memory-limited container, a single HTTP PUT request carrying approximately 4.5 MB of JSON body was sufficient to kill the RabbitMQ container, with Docker subsequently reporting the container state as exited: true.

Key technical characteristics:

• Attack surface: The management HTTP API (default port 15672) with the Stream Management plugin enabled.
• Precondition: A valid authenticated management user with access to the target vhost. No elevated privileges on the target streams are required.
• Mechanism: Premature, unbounded memory allocation driven by attacker-controlled input length, ahead of an authorization gate.
• Effect: Out-of-memory condition terminating the broker; the amplification ratio between request size (~4.5 MB) and impact (node kill under 768 MB limit) makes this highly efficient for an attacker.

No specific function, class, or parameter names beyond those in the NVD description (binding-keys field; PUT /api/stream/super-streams/{vhost}/{name}) should be inferred; additional implementation detail is not available from the supplied data.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-67408. The attack chain below is inferred strictly from the vulnerability class and the details provided in the NVD description.

1. Reconnaissance / target identification. The attacker identifies a RabbitMQ node with the Stream Management plugin enabled and the management HTTP API reachable. This is commonly exposed on TCP port 15672 and can be located via Shodan using the dorks listed in the metadata (e.g., http.title:"RabbitMQ Management"). The attacker must possess credentials for a management user that has access to at least one vhost.

2. Triggering the flaw class. Using those low-privileged credentials, the attacker issues an HTTP PUT to /api/stream/super-streams/{vhost}/{name}, where {vhost} is a vhost the account can access and {name} is an arbitrary super-stream name. The request body is JSON containing a binding-keys field. The description confirms the handler parses the attacker-controlled, comma-separated binding-keys string and builds the full stream-name list before the resource permission check — so the authorization gate that should stop an unprivileged user does not run until after the memory has already been consumed.

3. Payload / execution method. The attacker sets binding-keys to a very long comma-separated string, enlarging the JSON body toward the size the description identifies as sufficient (roughly 4.5 MB in the documented test). No code-execution primitive is involved; the "payload" is simply the attacker-controlled body length that drives transient allocation. Because the account lacks configure, write, or read on the resulting streams, a correctly ordered handler would reject the request — but the allocation already occurs first.

4. Post-exploitation impact. Memory pressure spikes until the broker hits its memory ceiling. In the memory-limited container tested in the report (768 MB), the node was killed and the container entered the exited: true state. For the attacker this yields a low-cost denial of service against the broker: existing producers, consumers, and streams are disrupted until the node is restarted and recovers. Repeated requests sustain the outage. No confidentiality or integrity impact is described — this is purely an availability attack.

Impact Assessment

The impact is availability-only, consistent with the CWE-400 classification and the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H:

• Attack Vector (AV:N): Exploitable over the network via the management HTTP API.
• Attack Complexity (AC:L): No special conditions; a straightforward crafted request succeeds.
• Privileges Required (PR:L): Requires an authenticated management user, but crucially only low privileges and vhost access.
• User Interaction (UI:N): None required.
• Scope (S:U): Impact confined to the vulnerable component.
• Confidentiality/Integrity (C:N/I:N): No direct impact.
• Availability (A:H): Complete loss of availability of the broker node.

Blast radius. Any RabbitMQ deployment running an affected version (4.1.0–4.3.2) with the Stream Management plugin enabled and a management API accessible to authenticated low-privileged users. In clustered topologies, killing a single node can trigger queue unavailability, consumer disconnections, and rebalancing disruption for downstream applications. Because the required privilege is minimal, the effective trust boundary is weak: any account provisioned for monitoring, dashboards, or limited operational tasks may be sufficient. The low request-to-impact ratio (~4.5 MB body to kill a 768 MB node) makes this practical even over constrained network paths.

Detection Guidance

Sigma Rule

title: RabbitMQ Super-Stream Binding-Keys Resource Exhaustion (CVE-2026-67408)
id: 8f1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects oversized or anomalous PUT requests to the RabbitMQ Stream Management super-streams API that may indicate CVE-2026-67408 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-67408
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: rabbitmq
detection:
  selection_method:
    cs-method: 'PUT'
  selection_uri:
    cs-uri-stem|startswith: '/api/stream/super-streams/'
  selection_body:
    cs-body|contains: 'binding-keys'
  selection_size:
    sc-bytes|gte: 1000000
  condition: selection_method and selection_uri and selection_size
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - sc-bytes
falsepositives:
  - Legitimate bulk super-stream configuration with very large binding-key lists
level: high

YARA Rule

rule CVE_2026_67408_RabbitMQ_SuperStream_BindingKeys
{
    meta:
        description = "Detects HTTP PUT requests abusing RabbitMQ super-stream binding-keys allocation (CVE-2026-67408)"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-67408"
        date = "2026-01-01"
        severity = "high"

    strings:
        $put = "PUT /api/stream/super-streams/"
        $binding = "binding-keys"
        $json = "\"binding-keys\""

    condition:
        uint16(0) == 0x4854 or $put or ($binding and $json)
}

Suricata IDS Rule

alert http any any -> any 15672 (msg:"CVE-2026-67408 RabbitMQ Super-Stream Binding-Keys Resource Exhaustion Attempt"; flow:to_server,established; http.method; content:"PUT"; http.uri; content:"/api/stream/super-streams/"; http.request_body; content:"binding-keys"; dsize:>1000000; classtype:attempted-dos; reference:cve,2026-67408; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-67408; sid:202667408; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [http where http.request.method == "PUT" and
        startsWith(http.request.uri.path, "/api/stream/super-streams/")]
  [http where http.request.method == "PUT" and
        startsWith(http.request.uri.path, "/api/stream/super-streams/") and
        http.request.body.content : "binding-keys"]

Splunk SPL Query

index=rabbitmq OR index=web
| search http_method="PUT" uri_path="/api/stream/super-streams/*"
| eval binding_keys_present=if(match(body, "binding-keys"), 1, 0)
| where binding_keys_present=1 OR body_bytes > 1000000
| stats count min(_time) as first_seen max(_time) as last_seen
        values(src_ip) as source_ips values(user) as users by uri_path
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="rabbitmq,cve-2026-67408,">
  <rule id="100674" level="12">
    <decoded_as>json</decoded_as>
    <field name="http_method">PUT</field>
    <field name="uri_path">/api/stream/super-streams/</field>
    <match>binding-keys</match>
    <description>CVE-2026-67408: Possible RabbitMQ super-stream binding-keys resource exhaustion attempt</description>
    <mitre>
      <id>T1499.004</id>
    </mitre>
    <group>dos,rabbitmq,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Restrict network access to the management HTTP API (default port 15672). Do not expose it to untrusted networks; place it behind authenticated reverse proxies, VPNs, or IP allowlists.
   • Disable the Stream Management plugin (rabbitmq_stream_management) on any node that does not require super-stream management via the HTTP API.
   • Audit and minimize management accounts that have vhost access. Revoke vhost access for accounts that do not require it, since any such account can trigger the pre-authorization allocation.
   • Enforce generous memory headroom (above the minimum container limit) and configure vm_memory_high_watermark / memory alarms so the broker blocks publishers before the OS OOM-killer terminates it.
   • Apply rate limiting and request-body size limits at the reverse proxy in front of the management API to block abnormally large binding-keys payloads.

2. Patch / upgrade steps.

   • Upgrade to RabbitMQ 4.3.3, 4.2.9, or 4.1.11 (the fixed releases), selecting the branch that matches your deployment line.
   • Verify the Stream Management plugin is present and loaded at the corrected version after upgrade.
   • Plan rolling upgrades in clustered environments to maintain availability; validate behavior with a low-privileged test account issuing super-stream requests.

3. Long-term hardening.

   • Adopt least-privilege management accounts and periodically review vhost and permission assignments.
   • Monitor broker memory metrics and alert on abnormal allocation spikes correlated with management API activity.
   • Keep RabbitMQ and its plugins within supported, patched release lines and subscribe to vendor security advisories.
   • Deploy the detection content above (Sigma, YARA, Suricata, Elastic, Splunk, Wazuh) to gain visibility into exploitation attempts.

References

• NVD — CVE-2026-67408: https://nvd.nist.gov/vuln/detail/CVE-2026-67408
• RabbitMQ Stream Management plugin documentation: https://www.rabbitmq.com/docs/stream
• RabbitMQ Management HTTP API reference: https://www.rabbitmq.com/docs/management
• CWE-400 — Uncontrolled Resource Consumption: https://cwe.mitre.org/data/definitions/400.html
• MITRE ATT&CK T1499.004 — Endpoint Denial of Service: Application or System Exploitation: https://attack.mitre.org/techniques/T1499/004/

No public proof-of-concept, exploit code, Nuclei template, or exploit-in-the-wild evidence was available at the time of writing. CVE-2026-67408 is not listed in CISA KEV, and no threat actor campaign has been attributed to it.