CVE-2026-67421

Analyzed Analyzed - Analysis Complete

Stored XSS in RabbitMQ Management UI via Queue Name

Publication date: 2026-09-25

Last updated on: 2026-10-06

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI was enabled. Exploitation requires an attacker with queue configure permission, a management administrator who can see but cannot read that queue, and the administrator clicking Get Message(s). A queue name containing a base element can then retarget the automatic relative refresh because the Content Security Policy omits base-uri and connect-src, and an attacker endpoint that permits the management origin through CORS can receive the victim's Authorization header. This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-06

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-67421

EUVD

EUVD-2026-87242

Affected Vendors & Products

Vendor	Product	Version / Range
broadcom	rabbitmq_server	From 3.13.0 (inc) to 3.13.9 (exc)
broadcom	rabbitmq_server	From 4.0.0 (inc) to 4.0.24 (exc)
broadcom	rabbitmq_server	From 4.1.0 (inc) to 4.1.15 (exc)
broadcom	rabbitmq_server	From 4.2.0 (inc) to 4.2.10 (exc)
broadcom	rabbitmq_server	From 4.3.0 (inc) to 4.3.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

RabbitMQ Management UI had a flaw where an attacker with queue configure permission could inject malicious HTML via a queue name. This occurred when an admin with limited permissions clicked Get Message(s) on a queue with a crafted name. The issue stemmed from missing Content Security Policy protections for base-uri and connect-src, allowing redirection to attacker-controlled endpoints.

Detection Guidance

This vulnerability requires specific conditions to be present: RabbitMQ versions between 3.13.0-3.13.19, 4.0.24, 4.1.15, 4.2.10, or 4.3.5 with OAuth management UI enabled. Detection involves checking RabbitMQ version and configuration. No direct commands are provided in the context to detect exploitation attempts.

Impact Analysis

An attacker could steal session cookies or sensitive data by tricking an admin into clicking a malicious queue. The attacker would need queue configure rights and the admin must have limited visibility but no read access to the queue. The stolen data could include authentication tokens or other sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR's confidentiality requirements or HIPAA's safeguards for protected health information. Organizations using affected RabbitMQ versions may face compliance breaches if exploited.

Mitigation Strategies

Upgrade RabbitMQ Management to versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, or 4.3.5 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-67421. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70