CVE-2026-67411

Executive Summary

CVE-2026-67411 is a source-address restriction bypass in RabbitMQ's native MQTT and MQTT-over-WebSocket listeners when deployed behind a trusted PROXY Protocol frontend. Under specific conditions, the proxy-derived client address can be lost before the MQTT authentication path evaluates loopback_users, causing the frontend-to-broker address to be incorrectly treated as loopback. An attacker with valid credentials for a loopback-restricted account, who can also reach the trusted frontend, can therefore authenticate from a non-loopback origin — circumventing the loopback-only access control. No public proof-of-concept, exploit code, or Nuclei template is currently available, and CISA KEV has not listed this CVE.

Technical Analysis

RabbitMQ is a widely deployed open-source messaging and streaming broker. It exposes a native MQTT plugin (and MQTT over WebSocket) that allows MQTT clients to publish and subscribe via the broker. RabbitMQ's loopback_users configuration is a security hardening control that restricts certain users — by default the built-in guest account — to connecting only from loopback addresses. This prevents unrestricted remote access to privileged accounts.

The vulnerable deployment topology is one where RabbitMQ sits behind a trusted frontend (for example, a load balancer or reverse proxy / TCP proxy) that terminates or forwards connections using the PROXY Protocol. The PROXY Protocol header carries the original client source address so that the broker can attribute the connection to its true origin rather than the proxy's address.

From RabbitMQ 3.13.0 onward, and prior to the fixed releases (3.13.18, 4.0.23, 4.1.14, 4.2.9, 4.3.3), the native MQTT and MQTT-over-WebSocket code paths could lose the proxy-derived client address before the authentication path checked loopback_users. When the address was lost, the broker fell back to treating the connecting address — the frontend-to-broker address — as if it were the client's address. Because the frontend-to-broker connection may originate from loopback, the check evaluated the connection as loopback-originating and the source-address restriction passed.

The consequence is a broken access-control decision: the loopback_users restriction is evaluated against the wrong address. CWE-863 (Incorrect Authorization) accurately classifies this: the authorization logic relies on source-address context that is no longer trustworthy at the moment of the check.

Important scoping constraints from the vendor description:

• The flaw does not bypass password authentication. An attacker must already possess valid credentials for a loopback-restricted account.
• It only affects deployments using the trusted PROXY Protocol frontend pattern for native MQTT or MQTT over WebSocket.
• It requires the attacker to be able to reach the trusted frontend.

No specific function names, MQTT packet structures, or code paths beyond those implied by the description ("proxy-derived client address", "loopback_users", "MQTT authentication path") are available. The precise location in the MQTT connection-handling code where the address is discarded is not disclosed in the provided data.

Exploitation Scenarios

Because no public exploit exists, the following chain is described strictly at the vulnerability-class level and is constrained by the deployment prerequisites stated by the vendor.

1. Reconnaissance / target identification. The attacker must first identify a RabbitMQ deployment that (a) enables the native MQTT or MQTT-over-WebSocket listener, (b) is positioned behind a frontend that advertises the PROXY Protocol and is trusted to supply the client address, and (c) uses loopback_users to restrict one or more accounts to loopback. Such deployments are commonly used for IoT ingestion and internal messaging where brokers sit behind load balancers. The attacker also needs valid credentials for a loopback-restricted account (for example, a leaked or reused guest-class credential).

2. Triggering the flaw class. The attacker connects to the trusted frontend from a non-loopback origin, targeting the MQTT listener (native MQTT or MQTT-over-WebSocket). Because the frontend is trusted, the frontend-to-broker address is what the broker sees once the proxy-derived address has been lost. The attacker supplies the loopback-restricted account's credentials. At the point the MQTT authentication path checks loopback_users, the address it evaluates is the frontend-to-broker address rather than the attacker's real origin.

3. Authentication / authorization result. Because the evaluated address is loopback, the loopback_users source-address restriction is satisfied. Combined with the valid password, authentication succeeds. The flaw is thus a broken authorization decision (CWE-863), not an authentication bypass — the credential requirement remains.

4. Post-exploitation impact. Once authenticated as the loopback-restricted account, the attacker gains the privileges that account holds on the broker: the ability to publish to and subscribe from queues/exchanges and to interact with the MQTT messaging fabric, subject to that account's permissions. From a messaging standpoint this can enable data exfiltration of in-flight messages, injection of forged messages, or disruption of downstream consumers. The full blast radius depends entirely on which loopback-restricted account was compromised and the ACLs attached to it.

No public PoC is available; the attack chain above is inferred from the vulnerability class and the vendor description. No payload format, wire-level MQTT sequence, or function-level detail can be responsibly specified from the data provided.

Impact Assessment

The primary impact is a source-address restriction bypass that converts a loopback-only account into a remotely reachable account — but only where the attacker already holds valid credentials. This is typically a privilege-escalation-across-a-trust-boundary scenario rather than an unauthenticated compromise.

The provided CVSS data is N/A; no official score or vector has been assigned. A representative qualitative breakdown, consistent with the prerequisites (network reachability plus valid credentials plus a specific proxy topology), is: availability of an exploit path over the network, high attack complexity due to the required frontend/credential preconditions, low privileges required (valid low-privileged account), and low-to-moderate confidentiality and integrity impact on the messaging fabric.

Business impact includes: exposure of message streams consumed under the compromised account, potential integrity loss where the account can publish, and trust-boundary erosion for IoT/edge pipelines that rely on loopback restrictions for their most sensitive accounts. The blast radius is bounded by the account's ACLs and the sensitivity of the messages flowing through the affected vhost.

Detection Guidance

Sigma Rule

title: RabbitMQ MQTT Loopback_Users Restriction Bypass via PROXY Protocol
id: 4b6f9c2e-1a7d-4e58-9c3b-2f8d0a6b7c41
status: experimental
description: Detects RabbitMQ MQTT/MQTT-over-WebSocket authentication as a loopback-restricted account originating from a non-loopback client, consistent with CVE-2026-67411.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-67411
author: valtersit.com
date: 2026/01/01
logsource:
  product: rabbitmq
  service: mqtt
detection:
  selection_loopback_user:
    event:
      - 'connection.accepted'
      - 'client.connected'
    user|contains:
      - 'guest'
  selection_proxy_origin:
    source_address|not:
      - '127.0.0.1'
      - '::1'
  selection_proxy_protocol:
    protocol:
      - 'mqtt'
      - 'mqtt_ws'
    proxy_protocol: 'true'
  condition: selection_loopback_user and selection_proxy_origin and selection_proxy_protocol
falsepositives:
  - Legitimate loopback-restricted accounts connecting through a trusted PROXY frontend from genuinely loopback origins
level: high
tags:
  - attack.t1078
  - cve.2026.67411

YARA Rule

rule CVE_2026_67411_RabbitMQ_MQTT_Loopback_Bypass
{
    meta:
        description = "Detects indicators of MQTT PROXY Protocol address handling relevant to CVE-2026-67411 in RabbitMQ configuration and log artifacts"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-67411"
        date = "2026-01-01"

    strings:
        $mqtt = "mqtt" ascii nocase
        $mqttws = "mqtt_ws" ascii nocase
        $loopback = "loopback_users" ascii nocase
        $proxy = "proxy_protocol" ascii nocase
        $guest = "guest" ascii

    condition:
        uint32be(0) != 0x504b0304 and
        filesize < 5MB and
        $loopback and $proxy and ($mqtt or $mqttws)
}

Suricata IDS Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 1883 (msg:"CVE-2026-67411 RabbitMQ MQTT PROXY Protocol Loopback-User Restriction Bypass - MQTT CONNECT"; flow:to_server,established; content:"|10|"; depth:1; content:"MQTT"; distance:0; content:"|04|"; distance:0; within:2; pcre:"/(?i)guest/"; reference:cve,2026-67411; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-67411; classtype:attempted-admin; sid:202667411; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET 15675 (msg:"CVE-2026-67411 RabbitMQ MQTT-over-WebSocket Loopback-User Restriction Bypass - Upgrade Request"; flow:to_server,established; content:"GET"; http_method; content:"Upgrade"; http_header; content:"mqtt"; http_header; nocase; content:"Sec-WebSocket-Protocol|3a| mqtt"; http_header; nocase; reference:cve,2026-67411; classtype:attempted-admin; sid:202667412; rev:1;)

Elastic Detection

sequence by host.id, process.entity_id with maxspan=30s
  [network where process.name == "beam.smp"
     and event.action == "connection_accepted"
     and network.transport == "tcp"
     and not cidrmatch(source.ip, "127.0.0.0/8", "::1/128")
     and network.destination.port in (1883, 8883, 15675)]
  [authentication where event.category == "authentication"
     and event.outcome == "success"
     and user.name != null
     and rabbitmq.proxy_protocol == true
     and rabbitmq.client.protocol in ("mqtt", "mqtt_ws")]

Splunk SPL Query

index=rabbitmq sourcetype=rabbitmq:log
  ("connection.accepted" OR "client.connected" OR "loopback_users")
  (mqtt OR mqtt_ws OR "proxy_protocol" OR "PROXY")
| eval is_loopback=if(match(src_ip, "^(127\.|::1)"), 1, 0)
| eval uses_proxy=if(match(_raw, "(?i)proxy_protocol"), 1, 0)
| eval loopback_acct=if(match(_raw, "(?i)(guest|loopback_user)"), 1, 0)
| where is_loopback=0 AND uses_proxy=1 AND loopback_acct=1
| stats count min(_time) as first_seen max(_time) as last_seen
    values(src_ip) as source_ips values(user) as users by host
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="rabbitmq,cve-2026-67411,">
  <rule id="20267411" level="12">
    <decoded_as>json</decoded_as>
    <field name="user">guest</field>
    <field name="protocol">mqtt</field>
    <match>proxy_protocol</match>
    <description>CVE-2026-67411 - RabbitMQ MQTT connection to loopback-restricted account via PROXY Protocol from non-loopback origin</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <options>no_full_log</options>
  </rule>

  <rule id="20267412" level="10">
    <decoded_as>json</decoded_as>
    <field name="protocol">mqtt_ws</field>
    <match>connection.accepted</match>
    <match>proxy_protocol</match>
    <description>CVE-2026-67411 - RabbitMQ MQTT-over-WebSocket connection accepted through PROXY Protocol frontend; verify client address attribution</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. The vendor description states the issue is fixed in versions 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3, but no patch source has been independently confirmed.

1. Immediate mitigations

   • Restrict network access to the trusted PROXY Protocol frontend so that only expected upstream networks can reach it, reducing the attacker population that can initiate the required connection path.
   • Disable the native MQTT and MQTT-over-WebSocket listeners if they are not operationally required; the flaw is confined to those listeners.
   • Review loopback_users and any account that depends on loopback restriction. Rotate credentials for such accounts and audit for reuse, since possession of a valid credential is the primary precondition for exploitation.
   • Where possible, avoid relying solely on loopback restriction for sensitive accounts and instead apply explicit per-user permissions and network-level ACLs.

2. Patch / upgrade steps

   • Upgrade to RabbitMQ 3.13.18, 4.0.23, 4.1.14, 4.2.9, or 4.3.3 (or later) as specified in the NVD description. Select the fixed release matching the deployed major/minor line.
   • After upgrade, verify that the MQTT authentication path correctly attributes the proxy-derived client address and that loopback_users is enforced against the true origin.

3. Long-term hardening

   • Treat frontend-supplied client addresses as untrusted input throughout the authentication and authorization path; validate consistent address attribution across all protocol listeners.
   • Monitor for non-loopback connections authenticating as loopback-restricted accounts.
   • Enforce least privilege on all messaging accounts and periodically audit vhost permissions.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-67411
• RabbitMQ MQTT Plugin documentation (vendor): https://www.rabbitmq.com/docs/mqtt
• RabbitMQ PROXY Protocol documentation (vendor): https://www.rabbitmq.com/docs/networking
• CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• CISA Known Exploited Vulnerabilities Catalog (not listed as of reporting): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, Nuclei template, or threat-actor campaign has been identified for CVE-2026-67411, and the vulnerability has not been added to CISA KEV.