CVE-2016-9877

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-12-29 · updated 2026-06-17
Weakness: CWE-284

Description

An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.

Affected products

rabbitmq-server: 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.1.0 (+26)
Pivotal RabbitMQ: 3.5.4, 3.5.5, 3.5.7, 3.6.0, 3.6.1, 3.6.2 (+38)

References

http://www.debian.org/security/2017/dsa-3761
http://www.securityfocus.com/bid/95065
https://pivotal.io/security/cve-2016-9877
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03880en_us
http://www.debian.org/security/2017/dsa-3761
http://www.securityfocus.com/bid/95065
https://pivotal.io/security/cve-2016-9877
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03880en_us

Get alerted when CVE-2016-9877 or the next vulnerability affects your stack