CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-66078

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, protected tag bypass via bulk-delete. dELETE /api/users/:name refuses to delete users tagged protected (rabbitmgmtwmuser:deleteresource/2 checks isprotecteduser). POST /api/users/bulk-delete iterates the supplied username list and calls rabbitauthbackendinternal:deleteuser/2 directly , that function has no protected-tag check , so the guard is silently An administrator can delete protected-tagged service accounts via the bulk endpoint, bypassing a safeguard the test suite confirms is rabbitmqmanagement enabled Attacker has the administrator tag A protected-tagged user. This issue is fixed in versions 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.004

EPSS Ranking 27.7%

CVSS Severity

CVSS v3 Score 5.5

References

Products affected by CVE-2026-66078

Broadcom » Rabbitmq Server » Version: 3.13.0

cpe:2.3:a:broadcom:rabbitmq_server:3.13.0
Broadcom » Rabbitmq Server » Version: 3.13.1

cpe:2.3:a:broadcom:rabbitmq_server:3.13.1
Broadcom » Rabbitmq Server » Version: 3.13.2

cpe:2.3:a:broadcom:rabbitmq_server:3.13.2
Broadcom » Rabbitmq Server » Version: 3.13.3

cpe:2.3:a:broadcom:rabbitmq_server:3.13.3
Broadcom » Rabbitmq Server » Version: 3.13.4

cpe:2.3:a:broadcom:rabbitmq_server:3.13.4
Broadcom » Rabbitmq Server » Version: 3.13.5

cpe:2.3:a:broadcom:rabbitmq_server:3.13.5
Broadcom » Rabbitmq Server » Version: 3.13.6

cpe:2.3:a:broadcom:rabbitmq_server:3.13.6
Broadcom » Rabbitmq Server » Version: 3.13.7

cpe:2.3:a:broadcom:rabbitmq_server:3.13.7
Broadcom » Rabbitmq Server » Version: 3.13.9

cpe:2.3:a:broadcom:rabbitmq_server:3.13.9
Broadcom » Rabbitmq Server » Version: 4.1.0

cpe:2.3:a:broadcom:rabbitmq_server:4.1.0
Broadcom » Rabbitmq Server » Version: 4.1.1

cpe:2.3:a:broadcom:rabbitmq_server:4.1.1
Broadcom » Rabbitmq Server » Version: 4.1.2

cpe:2.3:a:broadcom:rabbitmq_server:4.1.2
Broadcom » Rabbitmq Server » Version: 4.1.3

cpe:2.3:a:broadcom:rabbitmq_server:4.1.3
Broadcom » Rabbitmq Server » Version: 4.1.4

cpe:2.3:a:broadcom:rabbitmq_server:4.1.4
Broadcom » Rabbitmq Server » Version: 4.1.5

cpe:2.3:a:broadcom:rabbitmq_server:4.1.5
Broadcom » Rabbitmq Server » Version: 4.1.6

cpe:2.3:a:broadcom:rabbitmq_server:4.1.6
Broadcom » Rabbitmq Server » Version: 4.1.7

cpe:2.3:a:broadcom:rabbitmq_server:4.1.7
Broadcom » Rabbitmq Server » Version: 4.1.8

cpe:2.3:a:broadcom:rabbitmq_server:4.1.8

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-66078

Products

Pricing

Contact Us