What’s Vulnerable › Vulnerabilities
CVE-2018-1279: RabbitMQ cluster compromise due to deterministically generated cookie
- Severity: medium (CVSS 6.5 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2018-12-10 · updated 2026-06-17
- Weakness: CWE-330
Description
Pivotal RabbitMQ for PCF, all versions, uses a deterministically generated cookie that is shared between all machines when configured in a multi-tenant cluster. A remote attacker who can gain information about the network topology can guess this cookie and, if they have access to the right ports on any server in the MQ cluster can use this cookie to gain full control over the entire cluster.
Affected products
- Pivotal RabbitMQ: all versions
References
Get alerted when CVE-2018-1279 or the next vulnerability affects your stack