CVE-2026-66078: Rabbitmq Rabbitmq-Server

Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days.

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, protected tag bypass via bulk-delete. dELETE /api/users/:name refuses to delete users tagged protected (rabbitmgmtwmuser:deleteresource/2 checks isprotecteduser). POST /api/users/bulk-delete iterates the supplied username list and calls rabbitauthbackendinternal:deleteuser/2 directly , that function has no protected-tag check , so the guard is silently An administrator can delete protected-tagged service accounts via the bulk endpoint, bypassing a safeguard the test suite confirms is rabbitmqmanagement enabled Attacker has the administrator tag A protected-tagged user. This issue is fixed in versions 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6.

Affected products

• Rabbitmq Rabbitmq-Server: from 3.13.0, before 3.13.15 (fixed in 3.13.15); from 4.0.0, before 4.0.20 (fixed in 4.0.20); from 4.1.0, before 4.1.11 (fixed in 4.1.11); from 4.2.0, before 4.2.6 (fixed in 4.2.6)

Published 2026-09-25. Last modified 2026-09-29.