Skip to content
OpenAdvisories
High WID-SEC-2026-2268 29 CVEs

RabbitMQ: Mehrere Schwachstellen

Published Jul 9, 2026 · Updated Nov 4, 2026 · Revision 6 · de-DE

Vendor: Fedora Vendor: Ubuntu Product: Linux Product: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in RabbitMQ ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.

Product

RabbitMQ ist ein Open-Source Message Broker.

Vulnerabilities 29

  • Critical 9.2
    CVE-2026-67404

    RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch

    RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, When no CA bundle is available, ssl_options/1 falls back to [{verify, verify_none}] with no warning. An attacker in a man-in-the-middle position can for…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Critical 9.1
    CVE-2026-67231

    RabbitMQ: Trust-store whitelist by Issuer+Serial only

    RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verify_fun that overrides {bad_cert, unknown_ca} / {bad_cert, selfsigned_peer} when the presented cert "matches" a whi…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • High 8.2
    CVE-2026-66079

    RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS

    RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count fr…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • High 8.2
    CVE-2026-67232

    RabbitMQ: Web-MQTT decompression bomb

    RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress => true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set max_frame_size…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • High 7.6
    CVE-2026-66070

    RabbitMQ: CORS * reflects Origin with Allow-Credentials

    RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match_origin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origi…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-67237

    RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint

    RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorization header or access_token cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token …

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu
  • High 7.3
    CVE-2026-66077

    RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI

    RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which <%= ... %> does NOT HTML-escape. connection.ejs:135 renders <%= connection.ssl_details.peer_cert_subject %> (and peer_c…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2026-67238

    RabbitMQ: Atom-table exhaustion via reply-to queue name decoding

    RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/1 parses a caller-supplied ETF-encoded binary and calls binary_to_atom(Node, utf8) on the node-name field. It is reached from rabbit_volati…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu
  • Medium 6.9
    CVE-2026-67228

    RabbitMQ: Atom exhaustion: to_atom on runtime-parameter component

    RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The runtime-parameters lookup path coerces the URL :component segment to an atom with rabbit_data_coercion:to_atom/1 in lookup_component/1 (deps/rabbit/src/rabbit_runtime_paramet…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Medium 6.9
    CVE-2026-67229

    RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata

    RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, add_vhost/2 calls rabbit_data_coercion:atomize_keys/1 (the unsafe variant using binary_to_atom) on the vhost metadata map. The 20 MB management body lim…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Medium 6.3
    CVE-2026-67230

    RabbitMQ: Web-STOMP unbounded pre-auth accumulation

    RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced neither max_frame_size nor login_timeout before authentication, allowing an unauthenticated client to keep a connectio…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Medium 6.0
    CVE-2026-66067

    RabbitMQ: Stream protocol skips per vhost per user connection limits

    RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The stream open handler calls only check_vhost_access; it omits the node/vhost/user connection-limit checks that rabbit_reader performs for AMQP. A developer %% FIXME comment at …

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Medium 6.0
    CVE-2026-66072

    RabbitMQ: Atom table exhaustion via stream `chunk_selector`

    RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, get_chunk_selector/1 calls binary_to_atom on the raw client-supplied <<"chunk_selector">> property from post-auth subscribe and resolve_offset_spec fram…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Medium 6.0
    CVE-2026-66073

    RabbitMQ: Atom table exhaustion via management API node field

    RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node field. pUT /api/queues/:vhost/:name (and the exchanges and bindings endpoints) accepts a node JSON field. Th…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Medium 6.0
    CVE-2026-66074

    RabbitMQ: ReDoS via management API ?name= filter

    RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, match_value/3 passes the user-supplied ?name= regular expression to re:run with no match_limit option, and executes it once per resource in the result s…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Medium 6.0
    CVE-2026-67219

    RabbitMQ: Consistent-hash exchange unbounded weight

    RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, add_binding/3 parses the routing key as an integer weight N and computes ring positions with lists:seq(NextN0, NextN0 + N - 1). validate_binding/2 only …

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Medium 6.0
    CVE-2026-67220

    RabbitMQ: JMS topic exchange erl_scan atom exhaustion

    RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.0, When a binding is created on an x-jms-topic exchange, add_binding/3 reads the rjms_erlang_selector argument and passes it through erl_scan:string/1 then erl…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Medium 6.0
    CVE-2026-67233

    RabbitMQ: Monitoring-tag user can DELETE shovels

    RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The shovel management resource's is_authorized/2 delegates to rabbit_mgmt_util:is_authorized_monitor/2, which accepts the monitoring tag. But allowed_me…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Medium 5.9
    CVE-2026-67221

    RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords

    RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqp_uri:remove_credentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the pass…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Medium 5.9
    CVE-2026-67222

    RabbitMQ: list_to_atom on auth_mechanism URI tokens in amqp_client

    RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, mechanisms/1 applied list_to_atom/1 to every colon-delimited token in an attacker-controlled auth_mechanism value, permanently consuming Erlang VM atoms and al…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Medium 5.6
    CVE-2026-66068

    RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs

    RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, ?LOG_DEBUG("shutting down Shovel '~ts', ... Shovel state: ~tp", [Name, State]) formats the entire state map. The 'uris' field holds plaintext URIs after…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Medium 5.3
    CVE-2026-67405

    RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation)

    RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler (deps/rabbitmq_web_mqtt/src/rabbit_web_mqtt_handler.erl:104) nor the Web-STOMP handler (deps/rabbitmq_web_stomp/src/rabbit_…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Low 2.3
    CVE-2026-66069

    RabbitMQ: Monitoring-tag DELETE of auth-attempt metrics

    RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, is_authorized/2 uses is_authorized_monitor for all methods. DELETE resets rabbit_core_metrics:reset_auth_attempt_metrics(). Impact is cosmetic (counters only, no log era…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Low 2.3
    CVE-2026-66075

    RabbitMQ: Monitoring-tag user can restart federation links

    RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, is_authorized/2 for the /federation-links/.../restart route uses is_authorized_monitor (accepts the monitoring tag), while allowed_methods permits DELET…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Low 2.3
    CVE-2026-67234

    RabbitMQ: Non-RFC-conformant cookie name when clearing the auth-mechanism preference

    RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, get_auth_mechanism/1 used term_to_binary/1 on the strict_auth_mechanism or preferred_auth_mechanism atom when clearing the corresponding cookie, producing a non-ASCII cookie name …

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu
  • Low 2.3
    CVE-2026-67240

    RabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard

    RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, pattern_to_regex maps % -> .*? and _ -> ., then compiles ^...$ with only [unicode]; re:run is called with only [{capture, none}] - no explicit match_limit. A pattern like %_%_...…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu
  • Low 2.1
    CVE-2026-66078

    RabbitMQ: protected tag bypass via bulk-delete

    RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, protected tag bypass via bulk-delete. dELETE /api/users/:name refuses to delete users tagged protected (rabbitmgmtwmuser:deleteresource/2 checks isprotect…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Low 2.1
    CVE-2026-67218

    RabbitMQ: Super-stream HTTP creation skips configure-permission check

    RabbitMQ is a messaging and streaming broker. Prior to versions 4.0.22, 4.1.11, 4.2.6, and 4.3.0, accept_content/2 at line 56 calls rabbit_stream_manager:create_super_stream/... directly after is_authorized (which only checks the management tag + vhost access…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu
  • Low 2.1
    CVE-2026-67224

    RabbitMQ: Admin path-traversal write via trace name

    RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The trace consumer constructs the output path as filename:join(TraceDir, Name ++ ".log") where Name comes from PUT /api/traces/:vhost/:name. No safe_rel…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux

Revision history

  1. #6

    Neue Updates von Fedora aufgenommen

  2. #5

    Neue Updates von Ubuntu aufgenommen

  3. #4

    Referenz(en) aufgenommen: CVE-2026-66073, EUVD-2026-87149, CVE-2026-67237, EUVD-2026-87148, CVE-2026-67234, EUVD-2026-87146, CVE-2026-67230, EUVD-2026-87144, CVE-2026-67222, EUVD-2026-87143, CVE-2026-66078, EUVD-2026-87150

  4. #3

    Referenz(en) aufgenommen: CVE-2026-67233, EUVD-2026-85951

  5. #2

    CVE's ergänzt

  6. #1

    Initiale Fassung

References