Skip to content
OpenAdvisories
Medium WID-SEC-2026-2485 15 CVEs

RabbitMQ: Mehrere Schwachstellen

Published Jul 22, 2026 · Updated Nov 4, 2026 · Revision 5 · de-DE

Vendor: Fedora Vendor: Ubuntu Product: Linux Product: Linux Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in RabbitMQ ausnutzen, um Denial-of-Service-Angriffe durchzuführen, Autorisierungs- und Mandantengrenzen zu umgehen, Daten zu manipulieren oder offenzulegen und Cross Site Scripting Angriffe durchzuführen.

Product

RabbitMQ ist ein Open-Source Message Broker.

Vulnerabilities 15

  • High 8.2
    CVE-2026-67409

    RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS

    RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS (CWE-252). the JWKS key fetching mechanism in uaajwt.er…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • High 8.2
    CVE-2026-67410

    RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint

    RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.3.3 and 4.2.9, OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint (CWE-200). when OAuth2 authentication is enabled for the RabbitMQ Management UI and the configured flow, IDP u…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • High 7.6
    CVE-2026-67239

    RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UI

    RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-certificate DN in stream-management UI (sibling of V-11). lines 102/106/110 render peercertsubject / peercertissuer with…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2026-67408

    RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service

    RabbitMQ is a messaging and streaming broker. From 4.1.0 until 4.3.3, 4.2.9, and 4.1.11, Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service. rabbitMQ 4.3.1 with rabbitmqstreammanagement enabled accepts PUT /api/…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu
  • Medium 6.9
    CVE-2026-67226

    RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list

    RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7, Admin-only atom exhaustion: PUT /api/users tags list. settags/2 maps rabbitdatacoercion:toatom/1 over the user's tags list. The 20 MB management body limit fits ~3-4M …

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Medium 6.3
    CVE-2026-61837

    RabbitMQ: AMQP 1.0 management `GET /bindings` exposes full binding topology to any authenticated AMQP user without resource/management permission checks

    RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, AMQP 1.0 management GET /bindings exposes full binding topology to any authenticated AMQP user without resource/management permission checks. the AMQP 1.0 HTTP-ov…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu
  • Medium 6.3
    CVE-2026-67223

    RabbitMQ: LDAP DN injection via unescaped substitution

    RabbitMQ is a messaging and streaming broker. The advisory establishes affected 3.13, 4.0, 4.1, 4.2, and 4.3 maintenance lines but contains conflicting first-fixed versions for the 3.13, 4.0, and 4.1 lines. fill/2 substitutes ${username} into user_dn_pattern …

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Medium 6.3
    CVE-2026-67242

    RabbitMQ: OAuth2 is_integer(Exp) guard skips token-expiry checks for float exp

    RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, OAuth2 isinteger(Exp) guard skips token-expiry checks for float exp. validatetokenexpiry/1 (lines 208-214) and expirytimestamp/1 (138-144) both guard with 'when isinteger(Exp)' an…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu
  • Medium 6.0
    CVE-2026-67412

    RabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message access

    RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9 , 4.1.14, 4.0.24, and 3.13.18, Federation upstream in RabbitMQ skips vhost authorization allowing cross-vhost message access. what the bug lets you do. A policymaker on one vhost rea…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Medium 6.0
    CVE-2026-67413

    RabbitMQ: Authenticated RabbitMQ JMS Topic Selector Users Can Consume Broker CPU with an Unbounded LIKE Regular Expression

    RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.23, 4.1.14, 4.2.9, and 4.3.3, the optional rabbitmq_jms_topic_exchange plugin's x-jms-topic exchange accepted a client-controlled rjms_erlang_selector binding expression whose LIKE evaluator e…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Medium 5.9
    CVE-2026-67227

    RabbitMQ: Atom exhaustion: to_atom on global-parameter :name

    RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7 and 4.3.1, Atom exhaustion: toatom on global-parameter :name. resourceexists/2 (and the PUT/DELETE handlers) call rabbitdatacoercion:toatom/1 on the :name URL path segm…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Medium 5.9
    CVE-2026-67415

    RabbitMQ: Shovel Management Atom Exhaustion Allows Persistent Broker-Wide Denial of Service

    RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, the Shovel parameter parser converted attacker-controlled runtime parameter values into non-garbage-collected Erlang atoms before bounding them or checking a fixed allowlist. Expl…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Medium 5.1
    CVE-2026-67407

    RabbitMQ: Incomplete fix for CVE-2026-44838: `escape_regex_char/1` does not escape `-`, leaving room for an MQTT topic permission bypass

    RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3 and 4.2.9 and 4.1.14 and 4.0.23, Incomplete fix for CVE-2026-44838: escaperegexchar/1 does not escape -, leaving room for an MQTT topic permission bypass. the CVE-2026-44838 fix made expandt…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Medium 4.8
    CVE-2026-67241

    RabbitMQ: AMQP 1.0 management exchange.declare skips alternate-exchange permission check

    RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, AMQP 1.0 management exchange.declare skips alternate-exchange permission check. pUT /exchanges/:name (lines 192-240) checks only configure on the declared exchange and passes XArg…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu
  • Medium 4.6
    CVE-2026-67406

    RabbitMQ: Federation and Shovel Gen-Servers Lack format_status Callback — Plaintext Credentials Exposed in Crash Dumps and sys:get_status

    RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, Shovel does not format state logged by the crash reporter and can leave unencrypted credentials in a crash dump file. the shovel worker genserver processes does n…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux

Revision history

  1. #5

    Neue Updates von Fedora aufgenommen

  2. #4

    Neue Updates von Fedora aufgenommen

  3. #3

    Neue Updates von Ubuntu aufgenommen

  4. #2

    Referenz(en) aufgenommen: CVE-2026-67408, EUVD-2026-87241, CVE-2026-67241, EUVD-2026-87153, CVE-2026-67415, EUVD-2026-87225, CVE-2026-61837, EUVD-2026-87227, CVE-2026-67227, EUVD-2026-87237, CVE-2026-67410, EUVD-2026-87238, CVE-2026-67406, EUVD-2026-87240, CVE-2026-67242, EUVD-2026-87158, CVE-2026-67223, EUVD-2026-87156, CVE-2026-67239, EUVD-2026-87154, CVE-2026-67407, EUVD-2026-87236, CVE-2026-67226, EUVD-2026-87234, CVE-2026-67413, EUVD-2026-87228, CVE-2026-67412, EUVD-2026-87160, CVE-2026-67409, EUVD-2026-87159

  5. #1

    Initiale Fassung

References