CVE-2026-66077

Received Received - Intake

Stored XSS in RabbitMQ Management UI via Client Certificate Subject

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which <%= ... %> does NOT HTML-escape. connection.ejs:135 renders <%= connection.ssl_details.peer_cert_subject %> (and peer_cert_issuer) directly into the page. The same pattern appears in streamConnection.ejs:102,106,110. The values come from rabbit_ssl:peer_cert_subject/1 which formats the DN as a string without HTML escaping. The verifier corrected the original researcher's claim: this is reachable only when the listener is configured with verify_peer (so the certificate must be signed by a CA in the broker's trust store, not arbitrary self-signed); however, in deployments using mTLS for client authentication, any user who can request a certificate from the organisational CA controls the Subject CN. An attacker who can obtain a TLS client certificate signed by a CA the broker trusts (with verify_peer enabled) can embed JavaScript in the certificate's Subject DN. When any administrator views that connection in the management UI, the script executes in the admin's browser session, allowing full account takeover (create users, export definitions, etc.). The management UI's CSP includes 'unsafe-inline', so inline script execution is not blocked. Preconditions include TLS listener configured with ssl_options.verify = verify_peer Attacker can obtain a CA-signed client certificate with attacker-chosen Subject (e.g. self-service corporate PKI, or rabbitmq_trust_store plugin in use) Administrator views the connection detail page. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-23

Generated

2026-09-24

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-66077

EUVD

EUVD-2026-85628

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq	to 3.13.15\|end_excluding=4.0.20\|end_excluding=4.1.11\|end_excluding=4.2.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability in RabbitMQ involves a cross-site scripting (XSS) flaw in the management UI. The issue occurs because the UI uses EJS 1.0, which does not properly escape certain certificate details when rendering them in the browser. An attacker can exploit this by obtaining a TLS client certificate with a malicious Subject Distinguished Name (DN) and having an administrator view the connection in the management UI. The script embedded in the certificate then executes in the admin's browser, allowing full account takeover.

Detection Guidance

This vulnerability is specific to RabbitMQ management UI versions before 3.13.15, 4.0.20, 4.1.11, and 4.2.6. Check your RabbitMQ version with: rabbitmqctl status | grep RabbitMQ. If your version is below the patched versions, the system is vulnerable.

Impact Analysis

If you are an administrator using RabbitMQ's management UI with TLS listeners configured for client certificate verification, an attacker could gain control of your account. This could allow the attacker to create users, export system definitions, or perform other administrative actions. The impact is limited to users who have access to the management UI and are viewing connections with manipulated certificate details.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data or system configurations, potentially violating compliance requirements such as GDPR (data protection) or HIPAA (health information privacy). Unauthorized administrative access may result in data breaches or unauthorized modifications to systems, which could lead to regulatory penalties or loss of trust.

Mitigation Strategies

Upgrade RabbitMQ to version 3.13.15, 4.0.20, 4.1.11, or 4.2.6 or later immediately. Disable the management UI if not required. If using mTLS, ensure certificate Subject fields are validated and restricted to prevent malicious JavaScript injection.

Hi! I’m here to help you understand CVE-2026-66077. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70