CVE-2026-57213

Received Received - Intake

Stored XSS in RabbitMQ Federation Management Plugin

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_federation_management plugin renders the consumer_tag field on the Federation Status page without HTML escaping, allowing a user who can configure a federation upstream or policy to execute JavaScript in the browser of a user viewing that page. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-10

Last Modified

2026-07-10

Generated

2026-07-11

AI Q&A

2026-07-11

EPSS Evaluated

N/A

NVD

CVE-2026-57213

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq_federation_management	to 3.13.14 (exc)
rabbitmq	rabbitmq_federation_management	to 4.0.19 (exc)
rabbitmq	rabbitmq_federation_management	to 4.1.10 (exc)
rabbitmq	rabbitmq_federation_management	to 4.2.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the rabbitmq_federation_management plugin of RabbitMQ versions prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5. The issue is that the consumer_tag field on the Federation Status page is rendered without HTML escaping. This allows a user who has the ability to configure a federation upstream or policy to inject and execute JavaScript code in the browser of any user viewing that page.

Impact Analysis

The vulnerability can lead to cross-site scripting (XSS) attacks, where malicious JavaScript code is executed in the context of a user's browser. This can result in unauthorized actions such as stealing session tokens, redirecting users to malicious sites, or performing actions on behalf of the user without their consent. The impact depends on the privileges of the user viewing the Federation Status page and the nature of the injected script.

Mitigation Strategies

To mitigate this vulnerability, upgrade the rabbitmq_federation_management plugin to one of the fixed versions: 3.13.14, 4.0.19, 4.1.10, or 4.2.5.

Compliance Impact

The vulnerability allows execution of JavaScript in the browser of a user viewing the Federation Status page due to lack of HTML escaping in the consumer_tag field. This could potentially lead to cross-site scripting (XSS) attacks.

Such XSS vulnerabilities can impact the confidentiality and integrity of data displayed or processed through the affected interface, which may have implications for compliance with data protection regulations like GDPR or HIPAA that require safeguarding personal and sensitive information.

However, the provided information does not explicitly state the direct impact on compliance with these standards or regulations.

Hi! I’m here to help you understand CVE-2026-57213. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70