CVE-2026-67405

Analyzed Analyzed - Analysis Complete

Origin Header Validation Bypass in RabbitMQ

Publication date: 2026-09-23

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler (deps/rabbitmq_web_mqtt/src/rabbit_web_mqtt_handler.erl:104) nor the Web-STOMP handler (deps/rabbitmq_web_stomp/src/rabbit_web_stomp_handler.erl:102) validates the Origin header on the WebSocket upgrade. Under ssl_cert_login=true, the browser presents the client certificate automatically, so an attacker's JavaScript running in the victim's browser can authenticate as the victim. Preconditions include The non-default configuration use_http_auth=true (Web-STOMP) or ssl_cert_login=true (both plugins) must be enabled. The issue is harmless under the default in-band CONNECT credential configuration.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-10-19

Generated

2026-11-08

AI Q&A

2026-09-24

EPSS Evaluated

2026-11-07

NVD

CVE-2026-67405

Affected Vendors & Products

Vendor	Product	Version / Range
broadcom	rabbitmq_server	From 3.13.0 (inc) to 3.13.15 (exc)
broadcom	rabbitmq_server	From 4.0.0 (inc) to 4.0.20 (exc)
broadcom	rabbitmq_server	From 4.1.0 (inc) to 4.1.11 (exc)
broadcom	rabbitmq_server	From 4.2.0 (inc) to 4.2.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1385	The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

Executive Summary

RabbitMQ is a messaging broker with Web-MQTT and Web-STOMP handlers that did not validate the Origin header during WebSocket upgrades. This allowed an attacker's JavaScript in a victim's browser to authenticate as the victim when specific non-default configurations were enabled, such as use_http_auth=true for Web-STOMP or ssl_cert_login=true for both plugins.

Detection Guidance

Check RabbitMQ version to see if it is vulnerable. Use commands like 'rabbitmqctl status' or 'rabbitmq-diagnostics status' to verify version. If version is below 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.0, the system is vulnerable. Inspect Web-MQTT and Web-STOMP plugin configurations for use_http_auth=true or ssl_cert_login=true settings.

Impact Analysis

If you use RabbitMQ with the vulnerable configurations, an attacker could impersonate you by exploiting this flaw. This could lead to unauthorized access to your messaging system, data breaches, or manipulation of messages. The impact is limited to systems using the affected configurations.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR's data protection requirements or HIPAA's security rules. Organizations using RabbitMQ with the affected configurations may face compliance risks if the flaw results in data exposure or unauthorized access.

Mitigation Strategies

Upgrade RabbitMQ to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.0 or later to address the vulnerability. Disable the non-default configurations use_http_auth=true (Web-STOMP) or ssl_cert_login=true (both plugins) if they are enabled.

Hi! I’m here to help you understand CVE-2026-67405. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...