Why SolarWinds Observability Self-Hosted is not affected by multiple RabbitMQ vulnerabilities

10/14/2026 6:42 PM

10/14/2026 6:42 PM

In 2026, the National Institute of Standards and Technology (NIST) published security bulletins about the following RabbitMQ vulnerabilities:

NVD-CVE-2026-57220
NVD-CVE-2026-57217
NVD-CVE-2026-57213
NVD-CVE-2026-44839
NVD-CVE-2026-66072
NVD-CVE-2026-66075
NVD-CVE-2026-67224
NVD-CVE-2026-67233
NVD-CVE-2026-66071
NVD-CVE-2026-66070
NVD-CVE-2026-66068
NVD-CVE-2026-66076
NVD-CVE-2026-66077
NVD-CVE-2026-66078
NVD-CVE-2026-66079
NVD-CVE-2026-67219
NVD-CVE-2026-67220
NVD-CVE-2026-67221
NVD-CVE-2026-67222
NVD-CVE-2026-67225
NVD-CVE-2026-67230
NVD-CVE-2026-67231
NVD-CVE-2026-67232
NVD-CVE-2026-67404
NVD-CVE-2026-67405
NVD-CVE-2026-67223
NVD-CVE-2026-67239
NVD-CVE-2026-67409
NVD-CVE-2026-67411
NVD-CVE-2026-67412
NVD-CVE-2026-57211
NVD-CVE-2026-57218
NVD-CVE-2026-67418
NVD-CVE-2026-67420
NVD-CVE-2026-67421

Orion Platform

CVE-2026-57220 is a vulnerability in RabbitMQ Server where the stream listener fails to enforce the configured frame-size limit during authentication. An unauthenticated remote attacker can send oversized frames and exhaust broker memory, causing denial of service (DoS).

CVE-2026-57217 is a vulnerability in RabbitMQ Server's topic authorization mechanism. Errors retrieving topic permissions from the metadata store can cause authorization checks to fail open, potentially allowing an authenticated user to publish or bind to topics outside their assigned permissions.

CVE-2026-57213 is a stored cross-site scripting (XSS) vulnerability in the RabbitMQ Federation Management plugin. The Federation Status page renders an insufficiently sanitized consumer_tag, potentially allowing a user who can configure federation upstreams or policies to execute JavaScript in another user's browser.

CVE-2026-44839 is a cross-site scripting (XSS) vulnerability in the RabbitMQ Management UI caused by insufficient sanitization of virtual host names. A crafted virtual host name can inject malicious content into the management interface when viewed by another user.

CVE-2026-57211 is a vulnerability in the RabbitMQ Management plugin on Windows. Under certain configurations involving multiple management extension plugins, URL-encoded backslashes can reach file metadata handling before path validation, potentially triggering outbound DNS or SMB requests to attacker-controlled UNC paths.

CVE-2026-57218 is a vulnerability in RabbitMQ's OAuth2 authentication integration. Persisted consumer state can allow messages to remain accessible after a user's OAuth2 authorization has

CVE-2026-66072 is a denial-of-service vulnerability in RabbitMQ's Stream plugin. An authenticated stream client can supply an arbitrary chunk_selector value that is converted into an Erlang atom without adequate validation, potentially exhausting the atom table and crashing the broker.

CVE-2026-66075 is an authorization vulnerability in RabbitMQ Federation Management. A user with the monitoring role can restart federation links despite lacking the appropriate administrative privileges, potentially disrupting message delivery.

CVE-2026-66071 is a denial-of-service vulnerability in RabbitMQ's OAuth2 authentication backend. Under configurations where users can influence OAuth2 token scopes, specially crafted scope values can cause unbounded creation of Erlang atoms and eventually crash the broker.

CVE-2026-66070 is a cross-origin resource sharing (CORS) vulnerability in RabbitMQ Management. When wildcard CORS origins are configured, the server can reflect an attacker-controlled origin while allowing credentials, potentially enabling a malicious website to perform authenticated management API requests using an administrator's browser session.

CVE-2026-66068 is a credential-disclosure vulnerability in RabbitMQ Shovel logging. When debug logging is enabled and an automatically deleted Shovel completes, the broker can log its state containing decrypted connection URIs and plaintext credentials, exposing them to users who can read the logs.

CVE-2026-66076 is an authorization vulnerability in the RabbitMQ Management API. A user with the management role can retrieve Raft status information for quorum queues in virtual hosts they are not authorized to access, potentially disclosing queue names and cluster topology.

CVE-2026-66077 is a stored cross-site scripting (XSS) vulnerability in the RabbitMQ Management UI. Insufficient HTML escaping of TLS peer-certificate subject and issuer information can allow malicious JavaScript to execute in an administrator's browser when viewing a connection, provided the relevant mutual-TLS configuration and certificate conditions are met.

CVE-2026-66078 is an authorization vulnerability in the RabbitMQ Management API. The bulk-delete endpoint does not enforce the protection applied by the individual user-deletion endpoint, allowing an administrator to delete accounts marked as protected.

CVE-2026-66079 is a pre-authentication denial-of-service vulnerability in RabbitMQ's AMQP 1.0 protocol handling. A crafted array in an authentication frame can trigger the creation of an extremely large in-memory list, potentially exhausting memory and crashing the broker without authentication.

CVE-2026-67224 is a path-traversal vulnerability in RabbitMQ's tracing plugin. An administrator can provide a crafted trace name that is used to construct an output file path without adequate validation, potentially allowing the RabbitMQ process to write files outside the intended trace directory.

CVE-2026-67233 is an authorization vulnerability in RabbitMQ Shovel Management. A user with the monitoring role can access an endpoint that deletes or restarts Shovel runtime parameters without the required role checks, potentially disrupting message forwarding.

CVE-2026-67225 is a denial-of-service vulnerability in RabbitMQ's Stream protocol. The broker does not adequately enforce the negotiated maximum frame size on incoming frames, potentially allowing an authenticated client to send oversized data and exhaust broker resources.

CVE-2026-67230 is a denial-of-service vulnerability in RabbitMQ's Web STOMP plugin. Before authentication, WebSocket connections are not adequately constrained by frame-size and login-timeout limits, allowing an unauthenticated remote attacker to accumulate connection state and consume broker resources.

CVE-2026-67231 is an authentication-bypass vulnerability in RabbitMQ's Trust Store plugin. Certificate validation relies on issuer and serial-number information rather than adequately verifying the certificate's cryptographic identity, potentially allowing an attacker to authenticate using a forged certificate matching a trusted entry.

CVE-2026-67232 is a denial-of-service vulnerability in RabbitMQ's WebSocket handling. Insufficient restrictions on WebSocket compression can allow crafted requests to consume excessive broker resources.

CVE-2026-67219 is a denial-of-service vulnerability in RabbitMQ's consistent-hash exchange plugin. An authenticated user with appropriate binding permissions can specify an excessively large hash-ring weight, causing massive memory allocations and persistent cluster-wide resource consumption.

CVE-2026-67220 is a denial-of-service vulnerability in RabbitMQ's JMS topic exchange plugin. Crafted selector expressions can cause unbounded creation of Erlang atoms when bindings are processed, potentially exhausting the atom table and crashing the entire broker node.

CVE-2026-67221 is a credential-disclosure vulnerability in RabbitMQ Shovel. AMQP 1.0 Shovel connection URIs can be stored with embedded passwords instead of having their credentials removed, potentially exposing secrets through management API responses or status commands.

CVE-2026-67222 is a denial-of-service vulnerability in RabbitMQ's Shovel and Federation functionality. Crafted authentication-mechanism values can trigger excessive creation of Erlang atoms, potentially exhausting the atom table and crashing the broker. Exploitation requires appropriate policymaker privileges.

CVE-2026-67223 is an LDAP authentication vulnerability in RabbitMQ. When the LDAP backend uses a user_dn_pattern containing ${username}, insufficient escaping of the supplied username can allow manipulation of the constructed LDAP distinguished name, potentially causing authentication against an unintended directory entry under specific conditions.

CVE-2026-67239 is a stored cross-site scripting (XSS) vulnerability in RabbitMQ's Stream Management UI. Insufficient HTML escaping of TLS peer-certificate subject and issuer fields can allow malicious JavaScript to execute in an operator's browser when viewing connection details, provided the affected stream TLS configuration is enabled.

CVE-2026-67404 is a vulnerability in RabbitMQ's OAuth2 integration. When no usable CA bundle is available and certificate verification falls back to verify_none, a network attacker in a man-in-the-middle position may forge JWKS responses and cause the broker to accept attacker-controlled JWTs.

CVE-2026-67405 is a cross-site request forgery (CSRF)-related authentication vulnerability in RabbitMQ's Web MQTT and Web STOMP plugins. The WebSocket handlers do not validate the Origin header during connection upgrades, potentially allowing a malicious website to use a victim's client certificate in deployments with affected non-default authentication settings.

CVE-2026-67409 is a denial-of-service vulnerability in RabbitMQ's OAuth2/JWKS integration. The JWKS retrieval mechanism does not correctly handle HTTP error status codes, potentially deleting cached signing keys and preventing OAuth2/JWT authentication until valid keys are retrieved again.

CVE-2026-67411 is an authentication restriction bypass in RabbitMQ's MQTT plugin. When MQTT connections pass through a trusted PROXY Protocol frontend, the broker may incorrectly treat the connection as originating from a loopback address, potentially allowing a remote user with valid credentials for a loopback-restricted account to bypass the source-address restriction.

CVE-2026-67412 is an authorization vulnerability in RabbitMQ Federation. A policymaker operating in one virtual host can configure federation in a way that reads and consumes messages from another virtual host without the required access permissions, potentially exposing or deleting messages across tenant boundaries.

CVE-2026-67418 is a denial-of-service vulnerability in RabbitMQ's MQTT 5.0 plugin. An invalid or inapplicable property in a PUBLISH packet can cause matching subscribers to be disconnected, disrupting message delivery.

CVE-2026-67420 is an authorization vulnerability in RabbitMQ's OAuth2 integration. When an existing connection refreshes its OAuth2 token and loses previously granted runtime tags, RabbitMQ may retain the old privileges for that session, allowing operations that should no longer be authorized.

CVE-2026-67421 is a cross-site scripting and credential-exposure vulnerability in RabbitMQ Management. An authorization error containing an attacker-controlled queue name can be rendered as HTML in the OAuth-enabled management UI. Under specific conditions, a malicious queue name can redirect browser requests and expose an administrator's authorization header.

SolarWinds Observability Self-Hosted is not affected by CVE-2026-57220, CVE-2026-57217, CVE-2026-57213, CVE-2026-44839, CVE-2026-66072, CVE-2026-66075, CVE-2026-67224, CVE-2026-67233, CVE-2026-66071, CVE-2026-66070, CVE-2026-66068, CVE-2026-66076, CVE-2026-66077, CVE-2026-66078, CVE-2026-66079, CVE-2026-67219, CVE-2026-67220, CVE-2026-67221, CVE-2026-67222, CVE-2026-67225, CVE-2026-67230, CVE-2026-67231, CVE-2026-67232, CVE-2026-67404, CVE-2026-67405, CVE-2026-67223, CVE-2026-67239, CVE-2026-67409, CVE-2026-67411, CVE-2026-67412, CVE-2026-57211, CVE-2026-57218, CVE-2026-67418, CVE-2026-67420, CVE-2026-67421.

CVE-2026-57220, CVE-2026-66072, CVE-2026-67225: SolarWinds Observability Self-Hosted does not enable the RabbitMQ Stream plugin/listener. The vulnerable functionality is therefore not in the execution path of the deployed product.

CVE-2026-57213, CVE-2026-66075, CVE-2026-67233, CVE-2026-67222, CVE-2026-67412: SolarWinds Observability Self-Hosted does not enable the affected RabbitMQ Federation, Federation Management, Shovel, or Shovel Management functionality. The vulnerable functionality is therefore not in the execution path of the deployed product.

CVE-2026-67224: SolarWinds Observability Self-Hosted does not enable the RabbitMQ Tracing plugin. The vulnerable functionality is therefore not in the execution path of the deployed product.

CVE-2026-67219: SolarWinds Observability Self-Hosted does not enable the RabbitMQ Consistent Hash Exchange plugin. The vulnerable functionality is therefore not in the execution path of the deployed product.

CVE-2026-67220: SolarWinds Observability Self-Hosted does not enable the RabbitMQ JMS Topic Exchange plugin. The vulnerable functionality is therefore not in the execution path of the deployed product.

CVE-2026-67230: SolarWinds Observability Self-Hosted does not enable the RabbitMQ Web STOMP plugin. The vulnerable functionality is therefore not in the execution path of the deployed product.

CVE-2026-67231: SolarWinds Observability Self-Hosted does not enable the RabbitMQ Trust Store plugin. The vulnerable functionality is therefore not in the execution path of the deployed product.

CVE-2026-67232: SolarWinds Observability Self-Hosted does not enable the RabbitMQ Web MQTT plugin. The vulnerable functionality is therefore not in the execution path of the deployed product.

CVE-2026-66071, CVE-2026-67404, CVE-2026-67409, CVE-2026-57218, CVE-2026-67420: SolarWinds Observability Self-Hosted does not use the affected RabbitMQ OAuth2 authentication backend for its AMQP connections. The vulnerable authentication functionality is therefore not in the execution path of the deployed product.

CVE-2026-67421: SolarWinds Observability Self-Hosted does not use OAuth authentication or the OAuth-enabled RabbitMQ Management UI. The vulnerable functionality is therefore not in the execution path of the deployed product.

CVE-2026-66079, CVE-2026-67221: SolarWinds Observability Self-Hosted does not enable the RabbitMQ AMQP 1.0 plugin/listener or AMQP 1.0 Shovel functionality. The vulnerable protocol-handling functionality is therefore not in the execution path of the deployed product.

CVE-2026-57217: SolarWinds Observability Self-Hosted does not enable the RabbitMQ Khepri metadata store. The failure condition required to trigger the vulnerability is therefore not present in the deployed configuration.

CVE-2026-66070: SolarWinds Observability Self-Hosted does not configure wildcard values for the RabbitMQ cors_allow_origins setting. The configuration required to trigger the vulnerability is therefore not present.

CVE-2026-66068: SolarWinds Observability Self-Hosted does not use RabbitMQ Shovel with the combination of debug logging and auto-delete Shovel configuration required to expose credentials. The vulnerable execution conditions are therefore not present.

CVE-2026-66076: SolarWinds Observability Self-Hosted does not use RabbitMQ quorum queues and does not create additional virtual hosts with separately restricted management users. The conditions required to exploit the vulnerability are therefore not present in the deployed configuration.

CVE-2026-66077, CVE-2026-67239: SolarWinds Observability Self-Hosted does not require client-certificate verification (verify_peer) for the affected RabbitMQ TLS connections. The TLS configuration required to trigger the vulnerabilities is therefore not present.

CVE-2026-66078: SolarWinds Observability Self-Hosted does not configure RabbitMQ users with protected tags. The configuration required to trigger the vulnerability is therefore not present.

CVE-2026-67223: SolarWinds Observability Self-Hosted does not enable the RabbitMQ LDAP authentication backend. The vulnerable authentication functionality is therefore not in the execution path of the deployed product.

CVE-2026-67405: SolarWinds Observability Self-Hosted does not enable the RabbitMQ Web MQTT or Web STOMP plugins and does not use the affected HTTP or certificate-based authentication configuration. The conditions required to trigger the vulnerability are therefore not present.

CVE-2026-67411: SolarWinds Observability Self-Hosted does not enable the affected RabbitMQ MQTT/Web MQTT functionality or PROXY Protocol configuration, and the default guest account is removed. The conditions required to exploit the vulnerability are therefore not present.

CVE-2026-57211: The RabbitMQ Server version used by SolarWinds Observability Self-Hosted is not identified as affected by the applicable advisory. In addition, the extension plugins required for the described exploitation scenario are not enabled in the deployed product.

CVE-2026-44839: The RabbitMQ Server version used by SolarWinds Observability Self-Hosted is not affected according to the applicable maintainer advisory. In addition, SolarWinds Observability Self-Hosted does not use RabbitMQ virtual hosts, and the vulnerability requires the ability to create and delete virtual hosts.

CVE-2026-67418: SolarWinds Observability Self-Hosted does not enable the RabbitMQ MQTT plugin. The vulnerable MQTT functionality is therefore not in the execution path of the deployed product.