CVE-2026-67421

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.18 RabbitMQ versions 4.0.x prior to 4.0.24 RabbitMQ versions 4.1.x prior to 4.1.15 RabbitMQ versions 4.2.x prior to 4.2.10 RabbitMQ versions 4.3.x prior to 4.3.5

Description RabbitMQ Management renders an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI is enabled. An attacker with queue configure permission can exploit this by creating a queue name containing a base element. If a management administrator who can see but not read that queue clicks Get Message(s), the automatic relative refresh can be retargeted because the Content Security Policy (CSP) omits base-uri and connect-src. Consequently, an attacker endpoint that permits the management origin through Cross-Origin Resource Sharing (CORS) can receive the victim's Authorization header.

Recommendations Update to version 3.13.19 Update to version 4.0.24 Update to version 4.1.15 Update to version 4.2.10 Update to version 4.3.5