CVE-2026-57214

Received Received - Intake

Stored XSS in RabbitMQ Management UI via Unescaped HTML Title Attribute

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. Prior to 4.2.5, the RabbitMQ management UI renders the x-internal-purpose queue or exchange argument into an HTML title attribute without proper escaping on the Queues and Exchanges pages, allowing a user with permission to declare a queue or exchange to execute JavaScript in another user's browser. This issue is fixed in version 4.2.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-10

Last Modified

2026-07-10

Generated

2026-07-11

AI Q&A

2026-07-11

EPSS Evaluated

N/A

NVD

CVE-2026-57214

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq	to 4.2.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability exists in RabbitMQ versions prior to 4.2.5. The RabbitMQ management UI improperly handles the x-internal-purpose queue or exchange argument by rendering it into an HTML title attribute without proper escaping on the Queues and Exchanges pages.

Because of this improper escaping, a user who has permission to declare a queue or exchange can inject and execute JavaScript code in another user's browser when they view these pages.

This type of vulnerability is a Cross-Site Scripting (XSS) issue and it was fixed in RabbitMQ version 4.2.5.

Impact Analysis

This vulnerability can allow an attacker with permission to declare queues or exchanges to execute arbitrary JavaScript code in the browsers of other users who access the RabbitMQ management UI.

The impact includes potential theft of user session information, unauthorized actions performed on behalf of users, and other malicious activities that can be carried out through the injected script.

Since the vulnerability requires the attacker to have some level of permission, the risk depends on the access controls in place.

Mitigation Strategies

To mitigate this vulnerability, upgrade RabbitMQ to version 4.2.5 or later, where the issue is fixed.

Compliance Impact

This vulnerability allows a user with permission to declare a queue or exchange in RabbitMQ to execute JavaScript in another user's browser due to improper escaping in the management UI. Such cross-site scripting (XSS) issues can lead to unauthorized access to user sessions or data.

While the CVE description does not explicitly mention compliance with standards like GDPR or HIPAA, vulnerabilities that enable cross-site scripting can potentially lead to data breaches or unauthorized data exposure, which may violate requirements for protecting personal or sensitive information under these regulations.

Therefore, if exploited, this vulnerability could negatively impact compliance with data protection standards by exposing user data or sessions to attackers.

Hi! I’m here to help you understand CVE-2026-57214. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70