CVE-2026-67239

Undergoing Analysis Undergoing Analysis - In Progress

Stored XSS in RabbitMQ Stream Management UI

Publication date: 2026-09-25

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-certificate DN in stream-management UI (sibling of V-11). lines 102/106/110 render peercertsubject / peercertissuer with raw <%= %> and no fmtstring(). RFC4514 backslash-escaping of </> is HTML-inert and bypassable (<img ... //>). Requires non-default config: a stream TLS listener with verifypeer and an attacker-obtainable trusted cert with a malicious Same as the connection.ejs finding, against operators viewing the stream-connection detail rabbitmqstream + rabbitmqstreammanagement enabled with a TLS listener using verifypeer Attacker can obtain a certificate signed by a CA the listener trusts, with attacker-chosen DN An operator views the. This issue is fixed in versions 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-28

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-67239

EUVD

EUVD-2026-87154

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq	From 3.13.0 (inc) to 3.13.18 (inc)
rabbitmq	rabbitmq	to 4.0.23 (inc)
rabbitmq	rabbitmq	to 4.1.14 (inc)
rabbitmq	rabbitmq	to 4.2.9 (inc)
rabbitmq	rabbitmq	to 4.3.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in RabbitMQ's stream-management UI. It occurs when TLS peer-certificate Distinguished Names (DN) are rendered without proper escaping or formatting in the UI. Attackers can exploit this by obtaining a trusted certificate with malicious content in the DN, which is then displayed to operators viewing stream connections. The issue affects versions between 3.13.0 and 3.13.18, and 4.0.23 and earlier, 4.1.14 and earlier, 4.2.9 and earlier, and 4.3.3 and earlier.

Detection Guidance

Check RabbitMQ versions between 3.13.0-3.13.18 and 4.0.0-4.0.23 and 4.1.0-4.1.14 and 4.2.0-4.2.9 and 4.3.0-4.3.3 for the vulnerability. Verify if stream-management UI is enabled with TLS listener using verifypeer and attacker-obtainable trusted cert with malicious DN.

Impact Analysis

If you operate a RabbitMQ server with a stream TLS listener using verifypeer and the affected versions, an attacker could inject malicious scripts into the UI. This could lead to unauthorized actions, data theft, or session hijacking for users accessing the stream-management interface. The impact depends on the privileges of the affected users.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR's data protection requirements or HIPAA's security rules. Organizations could face compliance penalties if user data is exposed due to this flaw. Proper mitigation is required to maintain regulatory compliance.

Mitigation Strategies

Upgrade RabbitMQ to fixed versions: 3.13.18 or 4.0.23 or 4.1.14 or 4.2.9 or 4.3.3. Disable stream-management UI if not needed or ensure TLS listener does not use verifypeer with attacker-obtainable certs.

Hi! I’m here to help you understand CVE-2026-67239. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70