CVE-2026-67405

Received Received - Intake

Origin Header Validation Bypass in RabbitMQ

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler (deps/rabbitmq_web_mqtt/src/rabbit_web_mqtt_handler.erl:104) nor the Web-STOMP handler (deps/rabbitmq_web_stomp/src/rabbit_web_stomp_handler.erl:102) validates the Origin header on the WebSocket upgrade. Under ssl_cert_login=true, the browser presents the client certificate automatically, so an attacker's JavaScript running in the victim's browser can authenticate as the victim. Preconditions include The non-default configuration use_http_auth=true (Web-STOMP) or ssl_cert_login=true (both plugins) must be enabled. The issue is harmless under the default in-band CONNECT credential configuration.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-23

Generated

2026-09-24

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-67405

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq	to 4.3.0 (exc)
rabbitmq	rabbitmq	3.13.15
rabbitmq	rabbitmq	4.0.20
rabbitmq	rabbitmq	4.1.11
rabbitmq	rabbitmq	4.2.6
rabbitmq	rabbitmq	4.3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1385	The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

Executive Summary

RabbitMQ is a messaging broker with Web-MQTT and Web-STOMP handlers that did not validate the Origin header during WebSocket upgrades. This allowed an attacker's JavaScript in a victim's browser to authenticate as the victim when specific non-default configurations were enabled, such as use_http_auth=true for Web-STOMP or ssl_cert_login=true for both plugins.

Impact Analysis

If you use RabbitMQ with the vulnerable configurations, an attacker could impersonate you by exploiting this flaw. This could lead to unauthorized access to your messaging system, data breaches, or manipulation of messages. The impact is limited to systems using the affected configurations.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR's data protection requirements or HIPAA's security rules. Organizations using RabbitMQ with the affected configurations may face compliance risks if the flaw results in data exposure or unauthorized access.

Mitigation Strategies

Upgrade RabbitMQ to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.0 or later to address the vulnerability. Disable the non-default configurations use_http_auth=true (Web-STOMP) or ssl_cert_login=true (both plugins) if they are enabled.

Hi! I’m here to help you understand CVE-2026-67405. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70