Origin

This vulnerability was identified by Team RabbitMQ and/or other teams at Broadcom, not via a responsible disclosure from an external researcher.

Source references

deps/rabbitmq_stream/src/rabbit_stream_reader.erl:1515 · Access-control gap

Impact

An authenticated tenant can fully bypass operator-configured per-user and per-vhost connection caps by connecting via port 5552 instead of 5672.

Description

The stream open handler calls only check_vhost_access; it omits the node/vhost/user connection-limit checks that rabbit_reader performs for AMQP. A developer %% FIXME comment at the cited line explicitly acknowledges the gap. No compensating enforcement exists in connection tracking or elsewhere in rabbitmq_stream.

Exploit scenario

Operator sets rabbitmqctl set_user_limits tenant '{"max-connections":10}'. Tenant opens 1000 stream connections on port 5552; all succeed, exhausting file descriptors / scheduler capacity for other tenants.

Preconditions

• rabbitmq_stream plugin enabled
• Authenticated stream-protocol credentials
• Operator relies on per-user/per-vhost connection limits for tenant isolation

CVSS

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N (6.0, Moderate). Fixed in 4.2.7, 4.3.1.