Description
An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6; RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12 and 1.7.x before 1.7.7 | Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6; RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12 and 1.7.x before 1.7.7 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rabbitmq-server | 3.6.6-1 | — |
| Debian 13 | rabbitmq-server | 3.6.6-1 | — |
| Debian 12 | rabbitmq-server | 3.6.6-1 | — |
| Debian 8 | rabbitmq-server | 3.3.5-1.1+deb8u1 | DSA-3761-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | rabbitmq-server | 3.5.7-1ubuntu0.16.04.2 | USN-3374-1 |
| Ubuntu 14.04 LTS | rabbitmq-server | 3.2.4-1ubuntu0.1 | USN-3374-1 |
Advisories 2
- DSA-3761-1 rabbitmq-server - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-3374-1 rabbitmq-server vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026