CVE-2026-66070

Undergoing Analysis Undergoing Analysis - In Progress

Cross-Origin Resource Sharing Bypass in RabbitMQ Management Plugin

Publication date: 2026-09-23

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match_origin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with Access-Control-Allow-Credentials. The affected code is rabbit_mgmt_cors.erl. When the management plugin is configured with a wildcard CORS origin (cors_allow_origins = ""), the handler reflects the request Origin back in Access-Control-Allow-Origin and also sends Access-Control-Allow-Credentials: true. A malicious web page that a signed-in administrator visits can then use that administrator's cached HTTP Basic credentials to issue authenticated, state-changing requests to the management API. Preconditions include The management plugin is configured with the wildcard cors_allow_origins = "*", which is an explicit operator misconfiguration A target administrator has a cached HTTP Basic-auth session in the browser. This issue is fixed in versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-24

Generated

2026-10-14

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-12

NVD

CVE-2026-66070

EUVD

EUVD-2026-85625

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq	to 4.2.6 (exc)
rabbitmq	rabbitmq	4.3.0
rabbitmq	rabbitmq	4.2.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-942	The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.

Attack-Flow Graph

Executive Summary

This vulnerability in RabbitMQ Server occurs when the management plugin is misconfigured with a wildcard CORS origin. The system incorrectly reflects the Origin header in responses, allowing credentials to be exposed. A malicious website visited by an administrator with cached credentials could exploit this to make authenticated requests to the management API.

Detection Guidance

Check RabbitMQ management plugin configuration for wildcard CORS origin by inspecting the rabbitmq.conf or advanced.config files for the setting cors_allow_origins = "*". Verify the management plugin is enabled with netstat or ss commands like netstat -tulnp | grep 15672 or ss -tulnp | grep 15672.

Impact Analysis

If you are an administrator with cached HTTP Basic credentials and your RabbitMQ management plugin is misconfigured with a wildcard CORS origin, an attacker could trick you into visiting a malicious site. This could allow the attacker to perform state-changing actions on your RabbitMQ server using your credentials.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data or system configurations, potentially violating compliance requirements such as GDPR (data protection) or HIPAA (health information security). Unauthorized access may result in data breaches or loss of control over critical systems.

Mitigation Strategies

Upgrade RabbitMQ to versions 3.13.17, 4.0.22, 4.1.13, 4.2.6, or later. If upgrading is not possible immediately, disable the management plugin by setting management.listener.port to 0 in the configuration or remove the plugin entirely.

Hi! I’m here to help you understand CVE-2026-66070. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70