CVE-2026-67239

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.17 RabbitMQ versions 4.0.x through 4.0.22 RabbitMQ versions 4.1.x through 4.1.13 RabbitMQ versions 4.2.x through 4.2.8 RabbitMQ versions 4.3.x through 4.3.2

Description Stored Cross-Site Scripting (XSS) exists in the stream-management UI. The issue occurs when the system renders peercertsubject and peercertissuer using raw tags without proper string formatting. This allows an attacker to bypass RFC4514 backslash-escaping. Exploitation requires a non-default configuration where a stream TLS listener is enabled with verifypeer and the attacker possesses a trusted certificate with a malicious Distinguished Name (DN). The attack is triggered when an operator views the stream-connection details.

Recommendations Update to version 3.13.18 Update to version 4.0.23 Update to version 4.1.14 Update to version 4.2.9 Update to version 4.3.3