Description
An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. Several forms in the RabbitMQ management UI are vulnerable to XSS attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Pivotal RabbitMQ | Pivotal RabbitMQ | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rabbitmq-server | 3.6.10-1 | — |
| Debian 13 | rabbitmq-server | 3.6.10-1 | — |
| Debian 12 | rabbitmq-server | 3.6.10-1 | — |
| Debian 9 | rabbitmq-server | 3.6.6-1+deb9u1 | DLA-2710-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | rabbitmq-server | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud 7 | ansible | 2.2.3.0-12.2 | SUSE-RU-2020:2072-1 |
| SUSE OpenStack Cloud 7 | crowbar-core | 4.0+git.1580209654.1d112d31f-9.66.5 | SUSE-RU-2020:2072-1 |
| SUSE OpenStack Cloud 7 | crowbar-ha | 4.0+git.1585316203.d6ad2c8-4.52.4 | SUSE-RU-2020:2072-1 |
| SUSE OpenStack Cloud 7 | crowbar-openstack | 4.0+git.1589804581.9972163f0-9.71.4 | SUSE-RU-2020:2072-1 |
| SUSE OpenStack Cloud 7 | grafana | 4.6.5-1.14.1 | SUSE-RU-2020:2072-1 |
| SUSE OpenStack Cloud 7 | keepalived | 2.0.19-1.8.1 | SUSE-RU-2020:2072-1 |
| SUSE OpenStack Cloud 7 | kibana | 4.6.3-5.1 | SUSE-RU-2020:2072-1 |
| SUSE OpenStack Cloud 7 | memcached | 1.5.17-3.6.1 | SUSE-RU-2020:2072-1 |
| SUSE OpenStack Cloud 7 | monasca-installer | 20180608_12.47-12.1 | SUSE-RU-2020:2072-1 |
| SUSE OpenStack Cloud 7 | openstack-dashboard-theme-SUSE | 2016.2-5.12.4 | SUSE-RU-2020:2072-1 |
| SUSE OpenStack Cloud 7 | openstack-manila | 3.0.1~dev30-4.12.2 | SUSE-RU-2020:2072-1 |
| SUSE OpenStack Cloud 7 | openstack-manila-doc | 3.0.1~dev30-4.12.3 | SUSE-RU-2020:2072-1 |
| SUSE OpenStack Cloud 7 | openstack-neutron-fwaas | 9.0.2~dev5-4.9.3 | SUSE-RU-2020:2072-1 |
| SUSE OpenStack Cloud 7 | openstack-neutron-fwaas-doc | 9.0.2~dev5-4.9.4 | SUSE-RU-2020:2072-1 |
| SUSE OpenStack Cloud 7 | openstack-nova +1 | 14.0.11~dev13-4.40.2 | SUSE-RU-2020:2072-1 |
| SUSE OpenStack Cloud 7 | openstack-tempest | 12.2.1~a0~dev177-4.9.1 | SUSE-RU-2020:2072-1 |
| SUSE OpenStack Cloud 7 | python-Django | 1.8.19-3.23.1 | SUSE-RU-2020:2072-1 |
| SUSE OpenStack Cloud 7 | python-Pillow | 2.8.1-4.12.1 | SUSE-RU-2020:2072-1 |
| SUSE OpenStack Cloud 7 | python-psql2mysql | 0.5.0+git.1589351878.4ef877c-1.12.1 | SUSE-RU-2020:2072-1 |
| SUSE OpenStack Cloud 7 | python-psutil | 1.2.1-21.1 | SUSE-RU-2020:2072-1 |
| SUSE OpenStack Cloud 7 | python-py | 1.8.1-11.12.1 | SUSE-RU-2020:2072-1 |
| SUSE OpenStack Cloud 7 | python-pysaml2 | 4.0.2-3.17.1 | SUSE-RU-2020:2072-1 |
| SUSE OpenStack Cloud 7 | python-waitress | 1.4.3-3.3.1 | SUSE-RU-2020:2072-1 |
| SUSE OpenStack Cloud 7 | rabbitmq-server | 3.4.4-3.16.1 | SUSE-RU-2020:2072-1 |
| SUSE OpenStack Cloud 7 | release-notes-suse-openstack-cloud | 7.20180803-3.18.3 | SUSE-RU-2020:2072-1 |
| SUSE OpenStack Cloud 7 | rubygem-activeresource | 4.0.0-3.3.1 | SUSE-RU-2020:2072-1 |
| SUSE OpenStack Cloud 7 | rubygem-crowbar-client | 3.9.2-7.20.1 | SUSE-RU-2020:2072-1 |
| SUSE OpenStack Cloud 7 | rubygem-json-1_7 | 1.7.7-3.3.1 | SUSE-RU-2020:2072-1 |
| SUSE OpenStack Cloud 7 | rubygem-puma | 2.16.0-4.6.1 | SUSE-RU-2020:2072-1 |
| SUSE OpenStack Cloud 7 | zookeeper | 3.4.10-6.1 | SUSE-RU-2020:2072-1 |
Advisories 2
- DLA-2710-1 rabbitmq-server - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-RU-2020:2072-1 Security update for ansible, crowbar-core, crowbar-ha, crowbar-openstack, etcd, flannel, grafana, keepalived, kibana, memcached, monasca-installer, openstack-dashboard-theme-SUSE, openstack-manila, openstack-neutron-fwaas, openstack-nova, openstack-tempest, python-Django, python-Pillow, python-psql2mysql, python-psutil, python-py, python-pysaml2, python-waitress, rabbitmq-server, release-notes-suse-openstack-cloud, zookeeper SUSE / openSUSE Security Updates · Feb 4, 2026