CVE-2026-67234

Undergoing Analysis Undergoing Analysis - In Progress

RabbitMQ Cookie Handling Flaw Violates RFC 6265

Publication date: 2026-09-25

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, get_auth_mechanism/1 used term_to_binary/1 on the strict_auth_mechanism or preferred_auth_mechanism atom when clearing the corresponding cookie, producing a non-ASCII cookie name that violates RFC 6265 and can prevent the browser from deleting the preference. The issue is not directly exploitable for code execution or data exfiltration; its security relevance is limited to stale authentication-mechanism preferences persisting across logout and login cycles. This issue is fixed in versions 4.2.8 and 4.3.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-28

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-67234

EUVD

EUVD-2026-87146

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq	to 4.2.8 (inc)
rabbitmq	rabbitmq	4.3.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

RabbitMQ versions 4.2.0 to 4.2.8 and 4.3.2 had a flaw where get_auth_mechanism/1 converted strict_auth_mechanism or preferred_auth_mechanism atoms to binary using term_to_binary/1. This created non-ASCII cookie names that violated RFC 6265, causing browsers to fail to delete authentication preferences during logout.

Detection Guidance

This vulnerability is specific to RabbitMQ versions 4.2.0 to 4.2.8 and 4.3.0 to 4.3.2. To detect it, check your RabbitMQ version using the command: rabbitmqctl status | grep -i version. If your version falls within the affected range, the system is vulnerable.

Impact Analysis

The issue may cause stale authentication preferences to persist across login/logout cycles, potentially requiring manual cookie cleanup. It does not allow code execution or data theft but may disrupt expected authentication behavior.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it does not involve unauthorized data access, exfiltration, or privacy violations. The issue relates to stale authentication preferences persisting in cookies, which may cause login issues but does not compromise data security or privacy.

Mitigation Strategies

Upgrade RabbitMQ to a patched version (4.2.8 or 4.3.2 or later) immediately. For Debian/Ubuntu systems, use: sudo apt-get update && sudo apt-get install --only-upgrade rabbitmq-server. For RPM-based systems, use: sudo yum update rabbitmq-server. After upgrading, restart the RabbitMQ service.

Hi! I’m here to help you understand CVE-2026-67234. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70