SB2026070934 - Multiple vulnerabilities in RabbitMQ Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026070934

SB2026070934 - Multiple vulnerabilities in RabbitMQ Server

Published: July 9, 2026 Updated: July 24, 2026

Security Bulletin ID SB2026070934
CSH Severity
High
Patch available
YES
Number of vulnerabilities 33
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 9% Medium 15% Low 76%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 33 vulnerabilities.


1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary JavaScript in an administrator's browser session and take over the administrator account.

The vulnerability exists due to cross-site scripting in the management UI connection detail templates when rendering TLS peer certificate subject or issuer fields. A remote user can connect with a specially crafted CA-signed client certificate and cause an administrator to view the connection details page to execute arbitrary JavaScript in an administrator's browser session and take over the administrator account.

Exploitation requires a TLS listener configured with peer verification, the ability to obtain a trusted client certificate with attacker-controlled subject data, and administrator interaction with the connection detail page.


2) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the consistent-hash exchange binding handling when processing a queue binding request with an excessively large routing-key weight. A remote user can create a binding with an arbitrarily large integer weight to cause a denial of service.

Only instances with the rabbitmq_consistent_hash_exchange plugin enabled are vulnerable, and the oversized allocation is replicated across cluster nodes and persists across restarts.


3) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to create persistent cluster-wide resources without required configure permission.

The vulnerability exists due to missing authorization in the HTTP super-stream creation handler when handling HTTP API requests to create super-streams. A remote privileged user can send a crafted HTTP request to create persistent cluster-wide resources without required configure permission.

Only instances with the rabbitmq_stream_management plugin enabled are vulnerable.


4) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in validate_partitions when processing partition count values in super-stream partition requests. A remote privileged user can submit a request with an excessively large partition count to cause a denial of service.

The rabbitmq_stream_management plugin must be enabled, and exploitation requires access to the target vhost.


5) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the WebSocket path in the Web-STOMP handler when processing pre-authentication STOMP frames over WebSocket connections. A remote attacker can send a slow trickle of single-byte frames to cause a denial of service.

The rabbitmq_web_stomp plugin must be enabled.


6) Improper Certificate Validation (CVE-ID: N/A)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to bypass TLS client authentication.

The vulnerability exists due to improper certificate validation in the rabbitmq_trust_store verify_fun when handling a presented client certificate during the TLS handshake. A remote attacker can present a forged self-signed certificate with a matching issuer distinguished name and serial number to bypass TLS client authentication.

Exploitation requires the trust-store plugin to be enabled and used as the TLS verify function, and requires knowledge of the issuer and serial number of a whitelisted certificate.


7) Improper handling of highly compressed data (CVE-ID: N/A)

CWE-ID: CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of highly compressed data in the rabbit_web_mqtt_handler WebSocket handling path when processing a highly compressed WebSocket frame with permessage-deflate enabled. A remote attacker can send a specially crafted compressed WebSocket frame to cause a denial of service.

Only systems with the rabbitmq_web_mqtt plugin enabled are vulnerable.


8) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the amqp10_binary_parser array32 parser when parsing a crafted pre-authentication AMQP 1.0 SASL-init frame. A remote attacker can send a specially crafted frame to cause a denial of service.

Only nodes with the AMQP 1.0 listener enabled are vulnerable, and all tenants and protocols on the affected node lose service when the Erlang VM terminates.


9) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to delete protected-tagged service accounts.

The vulnerability exists due to missing authorization in the bulk-delete endpoint when processing bulk user deletion requests. A remote privileged user can send a specially crafted bulk-delete request to delete protected-tagged service accounts.

Exploitation requires the management plugin to be enabled and a protected-tagged user to exist.


10) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in rabbit_jms_topic_exchange.erl add_binding/3 when processing the rjms_erlang_selector binding argument on an x-jms-topic exchange. A remote user can send a specially crafted queue.bind request with arbitrary selector strings to cause a denial of service.

The rabbitmq_jms_topic_exchange plugin must be enabled, and exploitation can affect the entire broker node across tenants.


11) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper access control in the /federation-links/.../restart route when handling DELETE requests to restart federation links. A remote user can send a specially crafted DELETE request with monitoring-tag credentials to cause a denial of service.

Exploitation requires the rabbitmq_federation and rabbitmq_federation_management plugins to be enabled.


12) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to delete or restart dynamic shovels.

The vulnerability exists due to improper access control in the shovel management resource when handling DELETE requests to the shovels API endpoint. A remote user can send a crafted DELETE request to delete or restart dynamic shovels.

Only instances with the rabbitmq_shovel and rabbitmq_shovel_management plugins enabled are vulnerable.


13) Inefficient regular expression complexity (CVE-ID: N/A)

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to inefficient regular expression complexity in the management API list endpoints when processing a user-supplied ?name= regular expression with use_regex=true. A remote user can send a specially crafted request to cause a denial of service.

Exploitation requires a user account with the management tag. The regular expression is evaluated once per resource in the result set, which can lead to prolonged CPU consumption and scheduler saturation on large result sets.


14) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the AMQP 0-9-1 body assembly logic when processing published message body fragments after a crafted content-header declares an excessive BodySize. A remote user can send a specially crafted sequence of AMQP 0-9-1 publish frames to cause a denial of service.

Exploitation requires publish permission over AMQP 0-9-1.


15) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the management API node field handling in get_node/1 when processing crafted PUT requests to queue, exchange, or binding management endpoints. A remote user can send many requests with unique node values to cause a denial of service.

Exploitation requires a user account with the management tag and access to at least one vhost.


16) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the rabbitmq stream reader when processing client-supplied chunk_selector properties in post-auth subscribe and resolve_offset_spec frames. A remote user can repeatedly send crafted stream protocol frames with fresh chunk_selector values to cause a denial of service.

Only instances with the rabbitmq_stream plugin enabled are vulnerable.


17) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in rabbit_stream_super_stream_mgmt.erl when handling PUT requests to /api/stream/super-streams/{vhost}/{name} with a binding-keys field. A remote user can send a specially crafted request body to cause a denial of service.

Only instances with the rabbitmq_stream_management feature enabled are vulnerable, and reliable node termination was demonstrated in deployments running under a hard memory limit.


18) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to missing authorization in the quorum queue status management endpoint when handling GET requests to /api/queues/quorum/:vhost/:queue/status. A remote user can send a crafted request for a vhost they cannot access to disclose sensitive information.

Only instances with the management plugin enabled are vulnerable.


19) Cleartext storage of sensitive information (CVE-ID: N/A)

CWE-ID: CWE-312 - Cleartext Storage of Sensitive Information

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to cleartext storage of sensitive information in the AMQP 1.0 shovel status output when exposing shovel status via the management API or command-line status command. A remote privileged user can read stored connection URIs containing embedded credentials to disclose sensitive information.

The issue affects AMQP 1.0 shovels configured with URI-embedded credentials, and exploitation requires access to read shovel status.


20) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in auth_mechanism URI token processing in amqp_client when handling auth_mechanism query values. A remote privileged user can send a specially crafted request with a large number of colon-separated tokens to cause a denial of service.

Exploitation requires the Shovel or Federation plugin to be in use.


21) Improper Certificate Validation (CVE-ID: N/A)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to forge JWKS responses and cause the broker to accept arbitrary JWTs.

The vulnerability exists due to improper certificate validation in ssl_options/1 when fetching JWKS data with no CA bundle available. A remote attacker can perform a man-in-the-middle attack to forge JWKS responses and cause the broker to accept arbitrary JWTs.

The issue requires the OAuth2 plugin to be in use with no cacertfile configured and an empty or unreadable OS CA bundle.


22) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to write arbitrary .log-suffixed files to writable filesystem paths.

The vulnerability exists due to path traversal in the tracing plugin trace name handling when processing PUT requests to /api/traces/:vhost/:name. A remote privileged user can supply a crafted trace name containing traversal sequences to write arbitrary .log-suffixed files to writable filesystem paths.

Only instances with the rabbitmq_tracing plugin enabled are vulnerable, and the target path must be writable by the rabbitmq OS user.


23) Missing Origin Validation in WebSockets (CVE-ID: N/A)

CWE-ID: CWE-1385 - Missing Origin Validation in WebSockets

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to compromise the integrity of cross-origin WebSocket interactions.

The vulnerability exists due to missing origin validation in the Web-MQTT and Web-STOMP WebSocket handlers when processing WebSocket upgrade requests. A remote attacker can run malicious JavaScript in the victim's browser to compromise the integrity of cross-origin WebSocket interactions.

Exploitation requires user interaction and is only possible when the non-default configuration use_http_auth=true for Web-STOMP or ssl_cert_login=true for the affected plugins is enabled.


24) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in rabbit_stream_core when processing inbound stream-protocol frames before authentication. A remote attacker can send a frame with a declared size exceeding the negotiated frame_max to cause a denial of service.

The stream plugin must be enabled.


25) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in lookup_component/1 in rabbit_runtime_parameters.erl when processing the :component segment of runtime-parameter request URLs. A remote privileged user can send roughly one million requests with distinct component values to cause a denial of service.

Exploitation requires policymaker privileges.


26) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in vhost metadata import handling when importing a crafted definitions file via the definitions API. A remote privileged user can submit a definitions import request containing a large number of unique metadata keys to cause a denial of service.

The issue is triggered during processing of vhost metadata keys with atomize_keys/1.


27) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in extract_scopes/1 in the OAuth2 authentication backend when processing user-influenced JWT scope values. A remote user can submit signed tokens with novel rabbitmq.tag: scope values to cause a denial of service.

Exploitation requires rabbitmq_auth_backend_oauth2 to be enabled and an IdP configuration that permits user-influenced scope values in signed tokens.


28) Overly permissive cross-domain whitelist (CVE-ID: N/A)

CWE-ID: CWE-942 - Overly Permissive Cross-domain Whitelist

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to issue authenticated, state-changing requests to the management API and compromise confidentiality and integrity.

The vulnerability exists due to permissive cross-domain security policy with untrusted domains in rabbit_mgmt_cors.erl when handling cross-origin requests with a wildcard CORS origin configuration. A remote attacker can host a malicious web page that causes a signed-in administrator's browser to send authenticated requests to compromise confidentiality and integrity.

User interaction is required, and exploitation depends on the management plugin being configured with cors_allow_origins = "*" and a target administrator having cached HTTP Basic credentials in the browser.


29) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to modify the integrity of authentication-attempt metrics.

The vulnerability exists due to missing authorization in the auth-attempt metrics DELETE endpoint when handling DELETE requests to /api/auth/attempts/:node. A remote user can send a DELETE request to reset per-node authentication-attempt counters to modify the integrity of authentication-attempt metrics.

The issue affects counters only and does not erase logs. Exploitation requires the management plugin to be enabled.


30) Inclusion of Sensitive Information in Log Files (CVE-ID: N/A)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local privileged user to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log files in rabbit_shovel_behaviour.erl when processing autodelete shovel completion with DEBUG logging enabled. A local privileged user can read the broker log file to disclose sensitive information.

The issue exposes decrypted amqp URIs containing embedded credentials in the logged shovel state map, and requires the shovel plugin with URI-embedded credentials and an autodelete shovel configuration.


31) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in rabbit_pid_codec:decompose_from_binary/1 when decoding caller-supplied ETF-encoded reply-to queue names. A remote user can send specially crafted AMQP requests with unique node names to cause a denial of service.

The issue is reachable through queue names or routing keys beginning with amq.rabbitmq.reply-to. and can crash the entire Erlang VM across all vhosts and connections.


32) Inefficient regular expression complexity (CVE-ID: N/A)

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to inefficient regular expression complexity in the AMQP 1.0 SQL filter LIKE handling when evaluating crafted LIKE filters against delivered messages. A remote user can attach a receiver with a crafted filter and publish messages with long property values to cause a denial of service.

Exploitation requires AMQP 1.0 with stream queues in use.


33) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the stream open handler when handling stream protocol connections over port 5552. A remote user can open excessive stream connections to cause a denial of service.

Exploitation requires valid stream-protocol credentials, the rabbitmq_stream plugin to be enabled, and reliance on per-user or per-vhost connection limits for tenant isolation.


Remediation

Install update from vendor's website.

References