Summary
It was discovered that RabbitMQ Server incorrectly handled CORS wildcard
origin configuration. An attacker could possibly use this issue to cause
a cross-site request forgery attack. This issue only affected Ubuntu 18.04
LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04
LTS. (CVE-2026-66070)
It was discovered that RabbitMQ Server incorrectly handled TLS
peer-certificate DNs in the management UI. An attacker could possibly use
this issue to cause a cross-site scripting attack. (CVE-2026-66077)
It was discovered that RabbitMQ Server incorrectly handled AMQP 1.0 arrays
with zero-width element constructors. An attacker could possibly use this
issue to cause a denial of service. This issue only affected Ubuntu 20.04
LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-66079)
It was discovered that RabbitMQ Server trust-store plugin incorrectly
validated client certificates. An attacker could possibly use this issue to
bypass TLS client authentication. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-67231)
It was discovered that RabbitMQ Server incorrectly handled WebSocket frame
sizes. An attacker could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,
Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67232)
It was discovered that RabbitMQ Server incorrectly handled content-header
body sizes. An attacker could possibly use this issue to cause a denial of
service. (CVE-2026-67235)
It was discovered that RabbitMQ Server incorrectly stored credentials in an
insecure cookie. An attacker could possibly use this issue to expose
sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu
22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67236)
It was discovered that RabbitMQ Server incorrectly handled OAuth bearer
tokens in bootstrap JavaScript. An attacker could possibly use this issue
to cause a cross-site scripting attack. This issue only affected Ubuntu
24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-67237)
It was discovered that RabbitMQ Server incorrectly handled ETF-encoded PID
node names. An attacker could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and
Ubuntu 26.04 LTS. (CVE-2026-67238)
It was discovered that RabbitMQ Server incorrectly handled TLS
peer-certificate DNs in the stream management UI. An attacker could
possibly use this issue to cause a cross-site scripting attack. This issue
only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-67239)
It was discovered that RabbitMQ Server incorrectly handled OAuth2 SSL
options when no CA certificates were available. An attacker could possibly
use this issue to bypass TLS verification. This issue only affected Ubuntu
26.04 LTS. (CVE-2026-67404)
It was discovered that RabbitMQ Server incorrectly validated HTTP response
status codes when fetching JWKS keys. An attacker could possibly use this
issue to cause a denial of service. This issue only affected Ubuntu 22.04
LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67409)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | rabbitmq-server | 3.9.27-0ubuntu0.6 |
| Ubuntu · 24.04 LTS 24.04:LTS | rabbitmq-server | 3.12.1-1ubuntu1.7 |
| Ubuntu · 26.04 LTS 26.04:LTS | rabbitmq-server | 4.0.5-10ubuntu5.2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | rabbitmq-server | 3.5.7-1ubuntu0.16.04.4+esm3 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | rabbitmq-server | 3.6.10-1ubuntu0.5+esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | rabbitmq-server | 3.8.3-0ubuntu0.3+esm2 |
Vulnerabilities 12
-
Critical 9.2
RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, When no CA bundle is available, ssl_options/1 falls back to [{verify, verify_none}] with no warning. An attacker in a man-in-the-middle position can for…
-
Critical 9.1
RabbitMQ: Trust-store whitelist by Issuer+Serial only
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verify_fun that overrides {bad_cert, unknown_ca} / {bad_cert, selfsigned_peer} when the presented cert "matches" a whi…
-
High 8.2
RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count fr…
-
High 8.2
RabbitMQ: Web-MQTT decompression bomb
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress => true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set max_frame_size…
-
High 8.2
RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused is_authorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration pro…
-
High 8.2
RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS (CWE-252). the JWKS key fetching mechanism in uaajwt.er…
-
High 7.6
RabbitMQ: CORS * reflects Origin with Allow-Credentials
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match_origin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origi…
-
High 7.6
RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UI
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-certificate DN in stream-management UI (sibling of V-11). lines 102/106/110 render peercertsubject / peercertissuer with…
-
High 7.5
RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorization header or access_token cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token …
-
High 7.3
RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which <%= ... %> does NOT HTML-escape. connection.ejs:135 renders <%= connection.ssl_details.peer_cert_subject %> (and peer_c…
-
High 7.1
RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size
RabbitMQ is a messaging and streaming broker. Prior to versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15, The content-header BodySize (a uint64) was stored without validation against max_message_size. The size check ran only when assembly completed. By decla…
-
High 7.1
RabbitMQ: Atom-table exhaustion via reply-to queue name decoding
RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/1 parses a caller-supplied ETF-encoded binary and calls binary_to_atom(Node, utf8) on the node-name field. It is reached from rabbit_volati…
References
-
report
https://ubuntu.com/security/CVE-2026-66070
-
report
https://ubuntu.com/security/CVE-2026-66077
-
report
https://ubuntu.com/security/CVE-2026-66079
-
report
https://ubuntu.com/security/CVE-2026-67231
-
report
https://ubuntu.com/security/CVE-2026-67232
-
report
https://ubuntu.com/security/CVE-2026-67235
-
report
https://ubuntu.com/security/CVE-2026-67236
-
report
https://ubuntu.com/security/CVE-2026-67237
-
report
https://ubuntu.com/security/CVE-2026-67238
-
report
https://ubuntu.com/security/CVE-2026-67239
-
report
https://ubuntu.com/security/CVE-2026-67404
-
report
https://ubuntu.com/security/CVE-2026-67409