Vulnerability · Published Sep 25, 2026 · Assigned by GitHub_M
CVE-2026-67421RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling
Medium 4.5
In plain English
A medium-severity missing authorization in rabbitmq-server from rabbitmq. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI was enabled. Exploitation requires an attacker with queue configure permission, a management administrator who can see but cannot read that queue, and the administrator clicking Get Message(s). A queue name containing a base element can then retarget the automatic relative refresh because the Content Security Policy omits base-uri and connect-src, and an attacker endpoint that permits the management origin through CORS can receive the victim's Authorization header. This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | rabbitmq-server | no fix listed | DEBIAN-CVE-2026-67421 |
| Debian:13 | rabbitmq-server | no fix listed | DEBIAN-CVE-2026-67421 |
| Debian:14 | rabbitmq-server | 4.3.6-1 | DEBIAN-CVE-2026-67421 |
| Ubuntu:22.04:LTS | rabbitmq-server | no fix listed | UBUNTU-CVE-2026-67421 |
| Ubuntu:24.04:LTS | rabbitmq-server | no fix listed | UBUNTU-CVE-2026-67421 |
| Ubuntu:26.04:LTS | rabbitmq-server | no fix listed | UBUNTU-CVE-2026-67421 |
| Ubuntu:26.10 | rabbitmq-server | no fix listed | UBUNTU-CVE-2026-67421 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| rabbitmq | rabbitmq-server | >= 3.13.0, < 3.13.19>= 4.0.0, < 4.0.24>= 4.1.0, < 4.1.15>= 4.2.0, < 4.2.10>= 4.3.0, < 4.3.5 |
Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N