Read the docs
TI-2024-34876 Aliases CVE-2024-51988GHSA-pj33-75x5-32j4

HTTP API's queue deletion endpoint does not verify that the user has a required permission

Priority LOW 29CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-284.

Summary

RabbitMQ is a feature rich, multi-protocol messaging and streaming broker. In affected versions queue deletion via the HTTP API was not verifying the `configure` permission of the user. Users who had all of the following: 1. Valid credentials, 2. Some permissions for the target virtual host & 3. HTTP API access. could delete queues it had no (deletion) permissions for. This issue has been addressed in version 3.12.11 of the open source rabbitMQ release and in versions 1.5.2, 3.13.0, and 4.0.0 of the tanzu release. Users are advised to upgrade. Users unable to upgrade may disable management plugin and use, for example, Prometheus and Grafana for monitoring.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00362 30th percentileScored 2026-11-07
Fix Fixed rabbit_common (Hex): 3.12.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rabbitmqrabbitmq-serverOpen source RabbitMQ: >= 3.12.7, < 3.12.11; Tanzu RabbitMQ: >= 2.0.0, < 3.13.0; Tanzu RabbitMQ: < 1.5.2—No fix listedCNA
—rabbit_common (Hex)3.12.7 to before 3.12.113.12.11Patch availableGHSA-pj33-75x5-32j4
  • rabbitmq-server Vendorrabbitmq Affected Open source RabbitMQ: >= 3.12.7, < 3.12.11; Tanzu RabbitMQ: >= 2.0.0, < 3.13.0; Tanzu RabbitMQ: < 1.5.2 Fixed in — No fix listed CNA
  • rabbit_common (Hex) Vendor— Affected 3.12.7 to before 3.12.11 Fixed in 3.12.11 Patch available GHSA-pj33-75x5-32j4

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*——Broadcom
  • cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:* Versions — — ·Broadcom

Remediation

  • Fix · GHSA-pj33-75x5-32j4 rabbit_common (Hex) Fixed in 3.12.11 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 2 products
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-51988
  2. 2026-10-03 Alias added: GHSA-pj33-75x5-32j4

References

Advisory 1

Other 3

  • TI-2026-41154 Improper authentication in rabbitmq-server CVSS 3.1CRITICAL 10.0
  • TI-2026-41149 RabbitMQ: UNC SSRF affecting the management UI on Windows CVSS 3.1CRITICAL 10.0
  • TI-2026-41158 Resource allocation without limits in rabbitmq-server CVSS 3.1HIGH 7.5
  • TI-2026-47695 RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint CVSS 4.0HIGH 8.2
  • TI-2026-47694 RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS CVSS 4.0HIGH 8.2
  • TI-2026-45167 RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading CVSS 4.0HIGH 7.5
See all 100 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences