Skip to content

Missing vhost access control

Moderate
dentarg published GHSA-r2mh-8vq6-qf7m Feb 12, 2026

Package

No package listed

Affected versions

<= 2.6.5

Patched versions

2.6.6

Description

Summary

An authenticated user could access metadata in the broker they should not have access to.

Impact

  • Read queue, exchange, and binding information from vhosts they should not have access to
  • View message statistics for unauthorized vhosts
  • Enumerate all vhosts configured on the server (brute force guessing)
  • List all resources in a given vhost on the server

Workarounds

  1. Restrict Management API access to trusted administrators only

References

Severity

Moderate

CVE ID

CVE-2026-25768

Weaknesses

No CWEs