Advisory severityHigh7.1Red Hat Linux

High [CVE-2026-67233] Privilege escalation allows monitoring users to delete shovels

This high-severity Red Hat Linux advisory covers CVE-2026-67233; related products: Red Hat Hardened Images.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-67233 Source published Sep 24, 2026Source updated Sep 24, 2026

VulniPulse record published Sep 25, 2026Record updated Sep 28, 2026

CVE-2026-67233

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

Privilege escalation allows monitoring users to delete shovels. Red Hat rates this important (CVSS 7.1).

Weakness: CWE-267. Red Hat lists fixing advisory RHSA-2026:67552 with package rabbitmq-server4-3-main-4.3.6-1.hum1.

Affected product named by the advisory: Red Hat Hardened Images.

Affected versions

< 3.13.15
< 4.0.20
< 4.1.11
< 4.2.6
< 4.3.1

Official advisory · high-confidence parse· fetched 8 days ago·verify at source

Fixed versions

rabbitmq-server4-3-main-4.3.6-1.hum1
RHSA-2026:67552

Official advisory · high-confidence parse· fetched 8 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation

Disable the shovel management extension on brokers that do not need to manage shovels over HTTP. Enable rabbitmq_shovel explicitly first so it stays active if it was only pulled in as a dependency: rabbitmq-plugins enable rabbitmq_shovel rabbitmq-plugins disable rabbitmq_shovel_management This removes the /api/shovels endpoint. Accounts with the policymaker or administrator tag can still delete shovels through /api/parameters, which enforces the correct role check. If the endpoint has to stay available, remove the monitoring tag from any account that should not be able to stop message flow.

Official advisory · high-confidence parse· fetched 8 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.