CVE-2019-11291: RabbitMQ XSS attack via federation and shovel endpoints

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-11-22 · updated 2026-06-17
Weakness: CWE-79

Description

Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name fields that could grant access to virtual hosts and policy management information.

Affected products

rabbitmq-server: from 3.7.0 before 3.7.20; 3.8.0 — fixed in 3.7.20
OpenStack: 15
VMware Tanzu RabbitMQ: from 1.16.0 before 1.16.7; from 1.17.0 before 1.17.4 — fixed in 1.16.7, 1.17.4
Pivotal RabbitMQ: from 3.8 before v3.8.1; from 3.7 before v3.7.20 — fixed in v3.8.1, v3.7.20
Pivotal RabbitMQ for Pivotal Platform: from 1.17 before 1.17.4; from 1.16 before 1.16.7 — fixed in 1.17.4, 1.16.7

How to fix

Upgrade to a fixed version: rabbitmq-server 3.7.20; VMware Tanzu RabbitMQ 1.16.7, 1.17.4; Pivotal RabbitMQ v3.8.1, v3.7.20; Pivotal RabbitMQ for Pivotal Platform 1.17.4, 1.16.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-11291 or the next vulnerability affects your stack