Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L P L N N N H 6.0 .0041 33.4 —
AFFECTED Product Versions Fixed rabbitmq-server >= 3.13.0, < 3.13.15 – —
TIMELINE Jul 23 Reserved by GitHub_M Sep 25 Published (CNA: GitHub_M) Oct 8 EXPLOIT PUBLISHED — CVE-2026-66073 (rabbitmq-server). Public exploit reference added.
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node field. pUT /api/queues/:vhost/:name (and the exchanges and bindings endpoints) accepts a node JSON field. The value goes through rabbitnodes:make → listtoatom with no cluster membership check first. Each unique value permanently leaks one atom. A March 2026 refactoring (ea61ce2563) introduced safe helpers in rabbitmgmtnodes.erl (parsenodename, safeatom, and requirenodename, using binarytoexistingatom) and fixed several callers (QQ replica ops, wmauthattempts, wmnodememoryets, getsortreverse, and rabbitfederationmgmt), but getnode/1 in rabbitmgmtutil.erl:880-885, the primary vector used by directrequest/6, was not Roughly 900K requests crash the VM via systemlimit, and all tenants lose Any user with the management tag and one vhost, the lowest privilege This issue is fixed in versions 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6.
| Date | Event | Detail |
|---|---|---|
| July 23, 2026 | Reserved | Reserved by GitHub_M |
| September 25, 2026 | Published | Published (CNA: GitHub_M) |
| October 8, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-66073 (rabbitmq-server). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| rabbitmq | rabbitmq-server | — | >= 3.13.0, < 3.13.15 | — |
Authoritative record: CVE-2026-66073 at cve.org
Vendors: rabbitmq
Weaknesses: CWE-400
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-66073 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
