p PatchFirst

CVE-2026-67421

CVE-2026-67421 · RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling

This page contains facts from public vulnerability sources. Check the original advisory before updating.

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI was enabled. Exploitation requires an attacker with queue configure permission, a management administrator who can see but cannot read that queue, and the administrator clicking Get Message(s). A queue name containing a base element can then retarget the automatic relative refresh because the Content Security Policy omits base-uri and connect-src, and an attacker endpoint that permits the management origin through CORS can receive the victim's Authorization header. This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.

CVSS 4.5 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: system · database

Affected products and versions

  • rabbitmq

    Versions
    • >= 3.13.0, < 3.13.19: Affected
    • >= 4.0.0, < 4.0.24: Affected
    • >= 4.1.0, < 4.1.15: Affected
    • >= 4.2.0, < 4.2.10: Affected
    • >= 4.3.0, < 4.3.5: Affected

    No fix published

  • rabbitmq-server Debian:12

    Versions
    • 3.10.8-1.1
    • 3.10.8-1.1+deb12u1
    • 3.10.8-2
    • 3.10.8-3
    • 3.10.8-4
    • 3.12.1-1
    • 3.12.1-1.1
    • 4.0.5-1
    • 4.0.5-10
    • 4.0.5-11
    • 4.0.5-12
    • 4.0.5-13
    • 4.0.5-14
    • 4.0.5-2
    • 4.0.5-3
    • 4.0.5-4
    • 4.0.5-5
    • 4.0.5-6
    • 4.0.5-8
    • 4.0.5-9
    • 4.3.0-1
    • 4.3.0-2
    • 4.3.0-3
    • 4.3.2-1
    • 4.3.2-2
    • 4.3.2-3
    • 4.3.2-4
    • 4.3.2-5
    • 4.3.6-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rabbitmq-server Debian:13

    Versions
    • 4.0.5-10
    • 4.0.5-11
    • 4.0.5-12
    • 4.0.5-13
    • 4.0.5-14
    • 4.0.5-6
    • 4.0.5-6+deb13u1
    • 4.0.5-6+deb13u2
    • 4.0.5-8
    • 4.0.5-9
    • 4.3.0-1
    • 4.3.0-2
    • 4.3.0-3
    • 4.3.2-1
    • 4.3.2-2
    • 4.3.2-3
    • 4.3.2-4
    • 4.3.2-5
    • 4.3.6-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rabbitmq-server Debian:14

    Versions
    • 4.0.5-10
    • 4.0.5-11
    • 4.0.5-12
    • 4.0.5-13
    • 4.0.5-14
    • 4.0.5-6
    • 4.0.5-8
    • 4.0.5-9
    • 4.3.0-1
    • 4.3.0-2
    • 4.3.0-3
    • 4.3.2-1
    • 4.3.2-2
    • 4.3.2-3
    • 4.3.2-4
    • 4.3.2-5
    Affected ranges
    • ECOSYSTEM: < 4.3.6-1

    Update to 4.3.6-1

  • rabbitmq-server Ubuntu:Pro:16.04:LTS

    Versions
    • 3.5.4-1
    • 3.5.4-3
    • 3.5.4-3.1
    • 3.5.7-1
    • 3.5.7-1ubuntu0.16.04.1
    • 3.5.7-1ubuntu0.16.04.2
    • 3.5.7-1ubuntu0.16.04.4
    • 3.5.7-1ubuntu0.16.04.4+esm1
    • 3.5.7-1ubuntu0.16.04.4+esm2
    • 3.5.7-1ubuntu0.16.04.4+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rabbitmq-server Ubuntu:Pro:18.04:LTS

    Versions
    • 3.6.10-1
    • 3.6.10-1ubuntu0.1
    • 3.6.10-1ubuntu0.3
    • 3.6.10-1ubuntu0.4
    • 3.6.10-1ubuntu0.5
    • 3.6.10-1ubuntu0.5+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rabbitmq-server Ubuntu:Pro:20.04:LTS

    Versions
    • 3.7.8-4ubuntu2
    • 3.7.18-1
    • 3.8.2-0ubuntu1
    • 3.8.2-0ubuntu1.1
    • 3.8.2-0ubuntu1.2
    • 3.8.2-0ubuntu1.3
    • 3.8.2-0ubuntu1.4
    • 3.8.2-0ubuntu1.5
    • 3.8.3-0ubuntu0.1
    • 3.8.3-0ubuntu0.2
    • 3.8.3-0ubuntu0.3
    • 3.8.3-0ubuntu0.3+esm1
    • 3.8.3-0ubuntu0.3+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rabbitmq-server Ubuntu:22.04:LTS

    Versions
    • 3.8.9-3ubuntu1
    • 3.9.8-1
    • 3.9.8-2
    • 3.9.8-3
    • 3.9.8-5
    • 3.9.8-6
    • 3.9.13-1
    • 3.9.13-1ubuntu0.22.04.1
    • 3.9.13-1ubuntu0.22.04.2
    • 3.9.27-0ubuntu0.1
    • 3.9.27-0ubuntu0.2
    • 3.9.27-0ubuntu0.5
    • 3.9.27-0ubuntu0.6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rabbitmq-server Ubuntu:24.04:LTS

    Versions
    • 3.12.1-1
    • 3.12.1-1ubuntu1
    • 3.12.1-1ubuntu1.2
    • 3.12.1-1ubuntu1.4
    • 3.12.1-1ubuntu1.6
    • 3.12.1-1ubuntu1.7
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rabbitmq-server Ubuntu:26.10

    Versions
    • 4.0.5-10ubuntu5
    • 4.3.2-4ubuntu2
    • 4.3.2-4ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rabbitmq-server Ubuntu:26.04:LTS

    Versions
    • 4.0.5-8ubuntu2
    • 4.0.5-10ubuntu1
    • 4.0.5-10ubuntu2
    • 4.0.5-10ubuntu3
    • 4.0.5-10ubuntu4
    • 4.0.5-10ubuntu5
    • 4.0.5-10ubuntu5.1
    • 4.0.5-10ubuntu5.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →