CVEvulnerability

CVE-2026-67421

4.5 MEDIUM Published 2026-09-25 Modified 2026-10-06 Official page ↗
Status
Analyzed
Published
2026-09-25
Last modified
2026-10-06
Assigner
[email protected]
CVSS 4.0 ([email protected])
4.5 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
6.8 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-862

Description

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI was enabled. Exploitation requires an attacker with queue configure permission, a management administrator who can see but cannot read that queue, and the administrator clicking Get Message(s). A queue name containing a base element can then retarget the automatic relative refresh because the Content Security Policy omits base-uri and connect-src, and an attacker endpoint that permits the management origin through CORS can receive the victim's Authorization header. This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.

Affected configurations

• broadcom rabbitmq server (>= 3.13.0 < 3.13.9) • broadcom rabbitmq server (>= 4.0.0 < 4.0.24) • broadcom rabbitmq server (>= 4.1.0 < 4.1.15) • broadcom rabbitmq server (>= 4.2.0 < 4.2.10) • broadcom rabbitmq server (>= 4.3.0 < 4.3.5)

Related

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References