CVE-2026-67224 RabbitMQ: Admin path-traversal write via trace name
Administrators can write arbitrary .log files to the filesystem via path traversal in the tracing plugin, potentially overwriting critical files.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-67224?
CVE-2026-67224 is a low-severity path traversal vulnerability in Broadcom Rabbitmq Server, published on 23 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The trace consumer constructs the output path as filename:join(TraceDir, Name ++ ".log") where Name comes from PUT /api/traces/:vhost/:name. No safe_relative_path / traversal check is applied on the write side, while the read side (rabbit_tracing_files.erl) does call rabbit_misc:safe_relative_path/1 , proving the omission is an oversight, not design. The .log suffix is forced and the endpoint requires administrator. A user with the administrator tag can write a .log-suffixed file to an arbitrary filesystem path writable by the rabbitmq user via the tracing plugin's name parameter, e.g. /etc/cron.d/x.log (if writable) or overwrite existing .log files outside the trace directory. Preconditions include rabbitmq_tracing plugin enabled administrator tag Target path writable by rabbitmq OS user. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.
Weakness: CWE-22
Which versions are affected by CVE-2026-67224?
1 open source package ship an affected version, including rabbitmq. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rabbitmq Bitnami | From 3.13.0 | 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.1 |
Products include Broadcom Rabbitmq Server.
How do I fix CVE-2026-67224?
Upgrade rabbitmq to a fixed version for your release line: 3.13.15, 4.0.20, 4.1.11 or 4.2.6.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-67224 being exploited?
There is no known exploitation of CVE-2026-67224 in the wild and no public exploit code.
Other vulnerabilities in Broadcom Rabbitmq Server
- CVE-2016-9877 Auth bypass in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6; RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12 and 1.7.x before 1.7.7
- CVE-2026-67404 RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch
- CVE-2026-67231 RabbitMQ: Trust-store whitelist by Issuer+Serial only
- CVE-2026-57219 Information disclosure in rabbitmq-server
- CVE-2026-67236 RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login
Sources
Also known as AZL-105317, BIT-rabbitmq-2026-67224, DEBIAN-CVE-2026-67224, GHSA-h7cq-qrr8-7vgc, UBUNTU-CVE-2026-67224.