Skip to content
OpenAdvisories
Medium WID-SEC-2026-2881 4 CVEs

RabbitMQ: Mehrere Schwachstellen

Published Aug 17, 2026 · Updated Nov 4, 2026 · Revision 6 · de-DE

Vendor: Fedora Product: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in RabbitMQ ausnutzen, um Berechtigungen zu erweitern, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren, beliebigen Code auszuführen oder Denial-of-Service-Zustände herbeizuführen.

Product

RabbitMQ ist ein Open-Source Message Broker.

Vulnerabilities 4

  • High 7.1
    CVE-2026-67419

    RabbitMQ: Consecutive topic wildcards cause combinatorial routing work

    RabbitMQ is a messaging and streaming broker. Prior to 4.3.5, an authenticated user who can bind a queue to a topic exchange and publish to it can use consecutive # segments in a binding key to make both topic matchers revisit the same trie-node and routing-k…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Medium 5.3
    CVE-2026-67418

    RabbitMQ MQTT 5: inapplicable PUBLISH property disconnects matching subscribers

    RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, the MQTT 5 parser in deps/rabbitmq_mqtt/src/rabbit_mqtt_packet.erl accepts Request-Problem-Information on PUBLISH packets even though the property is v…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Medium 4.5
    CVE-2026-67421

    RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling

    RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI was e…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux
  • Low 2.3
    CVE-2026-67420

    RabbitMQ OAuth credential refresh retains revoked runtime tags

    RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains revoked runtime tags. when an existing AMQP connection refreshes from an OAuth token that grants the imperson…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux

Revision history

  1. #6

    Neue Updates von Fedora aufgenommen

  2. #5

    Neue Updates von Fedora aufgenommen

  3. #4

    Referenz(en) aufgenommen: EUVD-2026-101419

  4. #3

    Neue Updates von Fedora aufgenommen

  5. #2

    Referenz(en) aufgenommen: EUVD-2026-87242, EUVD-2026-87243, EUVD-2026-87244

  6. #1

    Initiale Fassung

References