CVE-2026-67420

Description

When an existing AMQP connection refreshes from an OAuth token that grants the `impersonator` tag to a valid same-username token that **no longer** grants that tag, RabbitMQ updates the OAuth backend implementation (token/scopes/expiry) but leaves the connection's runtime `#user.tags` unchanged. `rabbit_access_control:check_user_id/2` then still honors the stale `impersonator` tag, so the connection (including newly opened channels) can continue publishing messages with a foreign AMQP `user_id` after that privilege should have been revoked. A fresh connection using the downgraded token correctly refuses the same publish, proving the defect is stale session state rather than the token itself.

CVSS Base Scores

Affected Products

References

• https://www.cve.org/CVERecord?id=CVE-2026-67420