Skip to content
OpenAdvisories
Medium WID-SEC-2026-1994 4 CVEs

RabbitMQ: Mehrere Schwachstellen

Published Jun 17, 2026 · Updated Sep 24, 2026 · Revision 4 · de-DE

Vendor: Red Hat Vendor: SUSE Product: Enterprise Linux Product: Linux Product: openSUSE Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in RabbitMQ ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, um Daten zu manipulieren, um Informationen offenzulegen, und um einen Denial of Service Angriff durchzuführen.

Product

RabbitMQ ist ein Open-Source Message Broker.

Vulnerabilities 4

  • High 7.1
    CVE-2026-57212

    RabbitMQ management HTTP API accepts request bodies larger than configured max_http_body_size

    RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_management HTTP API accepts oversized valid JSON bodies on with_decode and direct_request paths because read_complete_body checks the accumulated size befo…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2026-57214

    RabbitMQ: Stored XSS in RabbitMQ management UI

    RabbitMQ is a messaging and streaming broker. Prior to 4.2.5, the RabbitMQ management UI renders the x-internal-purpose queue or exchange argument into an HTML title attribute without proper escaping on the Queues and Exchanges pages, allowing a user with per…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Medium 6.5
    CVE-2026-57211

    RabbitMQ: UNC SSRF affecting the management UI on Windows

    RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbit_mgmt_wm_static can pass URL-encoded backslashes to erl_prim_loader:read_file_info before path validation when multipl…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Ubuntu Azure Linux
  • Medium 5.7
    CVE-2026-57213

    RabbitMQ: Stored XSS federation management plugin via unsanitized consumer_tag rendering

    RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_federation_management plugin renders the consumer_tag field on the Federation Status page without HTML escaping, allowing a user who can configure a federa…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux

Revision history

  1. #4

    Neue Updates von SUSE und openSUSE aufgenommen

  2. #3

    Neue Updates von Red Hat aufgenommen

  3. #2

    CVE's ergänzt

  4. #1

    Initiale Fassung

References