Description
An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. RabbitMQ management UI stores signed-in user credentials in a browser's local storage without expiration, making it possible to retrieve them using a chained attack.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Pivotal RabbitMQ | Pivotal RabbitMQ | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rabbitmq-server | 3.6.10-1 | — |
| Debian 13 | rabbitmq-server | 3.6.10-1 | — |
| Debian 12 | rabbitmq-server | 3.6.10-1 | — |
| Debian 9 | rabbitmq-server | 3.6.6-1+deb9u1 | DLA-2710-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | rabbitmq-server | 3.5.7-1ubuntu0.16.04.4+esm2 | USN-6265-1 |
Advisories 2
- USN-6265-1 rabbitmq-server vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
- DLA-2710-1 rabbitmq-server - security update Debian Security (DSA / DLA) · Mar 9, 2026