CVE-2026-67421: RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-09-25 · updated 2026-10-06
Weakness: CWE-862

Description

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI was enabled. Exploitation requires an attacker with queue configure permission, a management administrator who can see but cannot read that queue, and the administrator clicking Get Message(s). A queue name containing a base element can then retarget the automatic relative refresh because the Content Security Policy omits base-uri and connect-src, and an attacker endpoint that permits the management origin through CORS can receive the victim's Authorization header. This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.

Affected products

rabbitmq-server: from 3.13.0 before 3.13.9; from 4.0.0 before 4.0.24; from 4.1.0 before 4.1.15; from 4.2.0 before 4.2.10; from 4.3.0 before 4.3.5 — fixed in 3.13.9, 4.0.24, 4.1.15, 4.2.10, 4.3.5

How to fix

Upgrade to a fixed version: rabbitmq-server 3.13.9, 4.0.24, 4.1.15, 4.2.10. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-67421 or the next vulnerability affects your stack