Skip to content
OpenAdvisories
High RHSA-2026:35940 11 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Jul 29, 2026 · Updated Sep 8, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 rabbitmq-server4.2 0:4.2.8-1.hum1

Vulnerabilities 11

  • High 8.7
    CVE-2026-57219 Scanner template

    RabbitMQ: Unauthenticated disclosure of OAuth client credentials via an HTTP API endpoint with certain less common OAuth 2 configurations

    RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauth_client_secret, exposing credential…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-57220

    RabbitMQ: Stream listener does not enforce configured frame-size limit during authentication, permitting unauth'd mem-exhaust DoS

    RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, the RabbitMQ stream listener does not enforce the configured stream frame-size limit while assembling frames during authentication and before Tune negotiation, allowing an unauthenticated remote cl…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Ubuntu Azure Linux
  • High 7.1
    CVE-2026-57212

    RabbitMQ management HTTP API accepts request bodies larger than configured max_http_body_size

    RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_management HTTP API accepts oversized valid JSON bodies on with_decode and direct_request paths because read_complete_body checks the accumulated size befo…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2026-57214

    RabbitMQ: Stored XSS in RabbitMQ management UI

    RabbitMQ is a messaging and streaming broker. Prior to 4.2.5, the RabbitMQ management UI renders the x-internal-purpose queue or exchange argument into an HTML title attribute without proper escaping on the Queues and Exchanges pages, allowing a user with per…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • High 7.0
    CVE-2026-57215

    RabbitMQ: Direct-reply-to binding persistence can lead to unauthorized reply-channel injection and persistent phantom

    RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ allows foreign bindings to amq.rabbitmq.reply-to destinations because volatile direct-reply-to queues can be accepted at bind and route time but are missing fr…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • High 7.0
    CVE-2026-57217

    RabbitMQ: Topic authorization can lead to cross-tenant routing-key bypass

    RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.21, 4.1.11, and 4.2.6, RabbitMQ topic authorization can allow restricted topic writes and binds during metadata-store failures because topic-permission lookup errors from Khepri can collapse …

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Medium 6.8
    CVE-2026-57216

    RabbitMQ: AMQP 1.0, AMQP 0-9-1, Stream Protocol loopback enforcement can lead to remote guest sessions due to listener-address loopback checks

    RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication can allow a loopback-restricted user such as guest to connect remotely when traffic is accepted through a trust…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Medium 6.5
    CVE-2026-57211

    RabbitMQ: UNC SSRF affecting the management UI on Windows

    RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbit_mgmt_wm_static can pass URL-encoded backslashes to erl_prim_loader:read_file_info before path validation when multipl…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Ubuntu Azure Linux
  • Medium 5.7
    CVE-2026-57213

    RabbitMQ: Stored XSS federation management plugin via unsanitized consumer_tag rendering

    RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_federation_management plugin renders the consumer_tag field on the Federation Status page without HTML escaping, allowing a user who can configure a federa…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Medium 5.3
    CVE-2026-57221

    RabbitMQ: Passive queue/exchange declaration bypasses authorization checks, leaking queue metadata to unprivileged users

    RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ does not perform authorization checks on passive queue.declare and exchange.declare AMQP 0-9-1 operations, allowing any authenticated user who can connect to a…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Medium 4.9
    CVE-2026-57218

    RabbitMQ: AMQP 0-9-1 in combination with OAuth 2: consumer persistence can lead to post-revocation message disclosure

    RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expiry or connection.update_secret refresh to reduced scopes because existing consumers are not canceled…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-57214
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-57217
  • report
    https://access.redhat.com/security/cve/CVE-2026-57219
  • report
    https://access.redhat.com/security/cve/CVE-2026-57220
  • report
    https://access.redhat.com/security/cve/CVE-2026-57212
  • report
    https://access.redhat.com/security/cve/CVE-2026-57221
  • report
    https://access.redhat.com/security/cve/CVE-2026-57211
  • report
    https://access.redhat.com/security/cve/CVE-2026-57213
  • report
    https://access.redhat.com/security/cve/CVE-2026-57218
  • report
    https://access.redhat.com/security/cve/CVE-2026-57215
  • report
    https://access.redhat.com/security/cve/CVE-2026-57216
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_35940.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2499215
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-57211
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-57211
  • article
    https://github.com/rabbitmq/rabbitmq-server/commit/39c3a8e9c71da0403d8dfc13f700e60c936e3682
  • article
    https://github.com/rabbitmq/rabbitmq-server/commit/6730797f6a34b4e8308cea60adf1243857e70204
  • article
    https://github.com/rabbitmq/rabbitmq-server/pull/15803
  • article
    https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6
  • article
    https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-7v84-m3g5-vxq6
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2499205
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-57212
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-57212
  • article
    https://github.com/rabbitmq/rabbitmq-server/commit/3976d148901bdfa82e1cd60b7a4534e073266ba5
  • article
    https://github.com/rabbitmq/rabbitmq-server/commit/b8fc2ef7c50a2797d15e1ea7cf34f290032303bb
  • article
    https://github.com/rabbitmq/rabbitmq-server/pull/15712
  • article
    https://github.com/rabbitmq/rabbitmq-server/pull/15714
  • article
    https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.5
  • article
    https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5cmq-vp28-xqrj
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2499208
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-57213
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-57213
  • article
    https://github.com/rabbitmq/rabbitmq-server/commit/33dedfe4fd53ff009cc67ab36358d0624c6b2e53
  • article
    https://github.com/rabbitmq/rabbitmq-server/commit/c2d0d69edf01efbd6e87dfb250c373a32da957f8
  • article
    https://github.com/rabbitmq/rabbitmq-server/pull/15708
  • article
    https://github.com/rabbitmq/rabbitmq-server/pull/15711
  • article
    https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-qxrp-7cmp-p77h