CVE-2026-67237

Undergoing Analysis Undergoing Analysis - In Progress

Stored XSS in RabbitMQ Management UI via OAuth Token

Publication date: 2026-09-25

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorization header or access_token cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token content to execute JavaScript in the management UI origin. The endpoint is exposed before authentication only when management.oauth_enabled is true, and exploitation through the cookie path additionally requires the attacker to plant an access_token cookie on the management host. This issue is fixed in versions 4.2.8 and 4.3.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-28

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-67237

EUVD

EUVD-2026-87148

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq	to 4.2.8 (inc)
rabbitmq	rabbitmq	4.3.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

RabbitMQ versions 4.2.0 to 4.2.8 and 4.3.2 have a vulnerability where the set_token_auth/2 function inserts a bearer token from the Authorization header or access_token cookie into OAuth bootstrap JavaScript without proper escaping. This allows an attacker to inject JavaScript code that executes in the management UI origin if they control the token content.

Detection Guidance

To detect this vulnerability, check if your RabbitMQ management UI is exposed before authentication with OAuth enabled. Verify the version of RabbitMQ installed on your system. If it is between 4.2.0 and 4.2.8 or 4.3.0 and 4.3.2, the system is vulnerable.

Impact Analysis

An attacker could exploit this to run malicious JavaScript in the management UI, potentially stealing session cookies, performing actions on behalf of users, or manipulating the UI to deceive users. Exploitation requires specific conditions like OAuth being enabled or planting a malicious cookie.

Compliance Impact

This vulnerability allows attacker-controlled JavaScript execution in the management UI origin, which could lead to unauthorized data access or manipulation. This may violate GDPR's data protection requirements or HIPAA's security rules if exploited to access or alter protected health information.

Mitigation Strategies

Upgrade RabbitMQ to version 4.2.8 or 4.3.2 or later immediately. If upgrading is not possible, disable the management plugin or OAuth support in the management UI to prevent exposure before authentication.

Hi! I’m here to help you understand CVE-2026-67237. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70