Description
Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name fields that could grant access to virtual hosts and policy management information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Pivotal | RabbitMQ | 3.8 – < v3.8.1, 3.7 – < v3.7.20 | v3.8.1 |
| Pivotal | RabbitMQ for Pivotal Platform | 1.17 – < 1.17.4, 1.16 – < 1.16.7 | 1.17.4 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rabbitmq-server | 3.8.3-1 | — |
| Debian 13 | rabbitmq-server | 3.8.3-1 | — |
| Debian 12 | rabbitmq-server | 3.8.3-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 15 | rabbitmq-server | 3.7.23-2.el8ost | RHSA-2020:0553 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Hex | rabbit_common | >= 3.7.0, < 3.7.20 | 3.7.20 | GHSA-9pf7-f47q-mwpq |
| Hex | rabbit_common | >= 3.8.0, < 3.8.1 | 3.8.1 | GHSA-9pf7-f47q-mwpq |
Advisories 1
- RHSA-2020:0553 Red Hat Security Advisory: rabbitmq-server security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
References
- https://pivotal.io/security/cve-2019-11291
- RHSA-2020:0553 vendor-advisory