SB2026072454 - Multiple vulnerabilities in RabbitMQ Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072454

SB2026072454 - Multiple vulnerabilities in RabbitMQ Server

Published: July 24, 2026

Security Bulletin ID SB2026072454
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 17
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 24% Low 76%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 17 vulnerabilities.


1) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to exposure of sensitive information in rabbit_shovel_worker when crash reports or crash dumps are generated after shovel worker process failures. A remote privileged user can trigger shovel worker failures and access logged state data to disclose sensitive information.

Plaintext AMQP credentials and URIs stored in the shovel worker process state may be written to SASL error logs and Erlang crash dumps. Network partitions or connection failures can trigger the affected crash reporting path.


2) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the AMQP 1.0 type parser when parsing a crafted AMQP 1.0 frame containing many zero-width arrays. A remote user can send a specially crafted frame after completing a SASL handshake to cause a denial of service.

The issue is triggered in the connection reader before validation or authorization of the parsed frame body, and user interaction is not required.


3) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service in consumer sessions or channels.

The vulnerability exists due to improper input validation in the optimized AMQP 1.0 server_mode parser and cross-protocol conversion paths when processing AMQP 1.0 messages with symbolic body descriptors that match a fixed textual prefix but use a different encoded symbol length. A remote user can publish a specially crafted AMQP 1.0 message to cause a denial of service in consumer sessions or channels.

Exploitation requires the ability to authenticate over AMQP 1.0, write to a target exchange or queue, and have the stored message consumed through a strict AMQP 1.0 decoder or a protocol path that forces full AMQP body decoding.


4) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a persistent broker-wide denial of service.

The vulnerability exists due to uncontrolled resource consumption in the Shovel runtime parameter parser when handling management API requests that set Shovel runtime parameters. A remote privileged user can submit crafted Shovel parameter values with many unique atom-producing fields to cause a persistent broker-wide denial of service.

Only instances with the rabbitmq_shovel and rabbitmq_shovel_management plugins enabled are vulnerable. Stored malicious Shovel parameters can be reparsed after a broker restart, recreating atom pressure without another live request.


5) Missing Authorization (CVE-ID: CVE-2026-61837)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to missing authorization in the AMQP 1.0 HTTP-over-AMQP management endpoint GET /bindings when handling management requests over an AMQP 1.0 management link pair. A remote user can send a specially crafted GET /bindings request to disclose sensitive information.

The issue exposes binding topology within the virtual host, including source and destination names, routing keys, binding arguments, and binding location URIs.


6) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the PUT /api/users tags list handling in rabbit_auth_backend_internal.erl when processing a user-supplied tags list. A remote privileged user can send a specially crafted request with a large number of unique tag strings to cause a denial of service.

The issue can also be triggered when importing definitions.


7) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the rabbitmq_management global parameter endpoint when handling repeated requests to /api/global-parameters/:name with unique name values. A remote privileged user can send repeated crafted requests with unique path values to cause a denial of service.

The management plugin must be enabled, and exploitation requires approximately one million HTTP requests.


8) Unchecked Return Value (CVE-ID: N/A)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to unchecked return value in the JWKS key fetching mechanism in uaa_jwt.erl when processing JWKS endpoint responses during signing key refresh. A remote attacker can send a crafted JWT with an unknown kid value to cause a denial of service.

Exploitation requires RabbitMQ to be configured with OAuth2 authentication using JWKS-based key discovery, and the JWKS endpoint must return an error response with a valid JSON body that lacks a keys field.


9) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to exposure of sensitive information in the unauthenticated /js/oidc-oauth/bootstrap.js endpoint when serving JavaScript bootstrap content for the management UI. A remote attacker can send a crafted request to retrieve the OAuth2 client secret and disclose sensitive information.

Only deployments with the management UI enabled, OAuth2 authentication enabled, and a configured oauth_client_secret are vulnerable.


10) Insufficient Session Expiration (CVE-ID: N/A)

CWE-ID: CWE-613 - Insufficient Session Expiration

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to bypass token-expiry checks and retain access with an expired token.

The vulnerability exists due to improper expiration handling in rabbit_auth_backend_oauth2 token expiry validation when processing OAuth2 tokens with a floating-point exp claim. A remote attacker can present a previously valid signed token with a float exp value to bypass token-expiry checks and retain access with an expired token.

Exploitation requires the OAuth2 backend to be enabled, an identity provider that emits exp as a JSON float, and possession of a previously valid signed token.


11) Improper Encoding or Escaping of Output (CVE-ID: N/A)

CWE-ID: CWE-116 - Improper Encoding or Escaping of Output

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to bypass MQTT topic authorization.

The vulnerability exists due to improper escaping of special elements in rabbit_auth_backend_internal.erl escape_regex_char/1 and topic permission expansion when processing MQTT topic permission templates that place {client_id} inside a character class. A remote user can supply a crafted client_id value to bypass MQTT topic authorization.

The issue affects read and write topic checks only when templates embed {client_id} within a [...] character class.


12) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to bypass loopback-only user restrictions and authenticate to the MQTT service.

The vulnerability exists due to incorrect authorization in rabbit_web_mqtt_handler and rabbit_mqtt_processor when processing MQTT and MQTT over WebSocket connections behind a trusted PROXY Protocol frontend. A remote user can connect through the trusted frontend using valid credentials for a loopback-restricted account to bypass loopback-only user restrictions and authenticate to the MQTT service.

Exploitation requires `web_mqtt.proxy_protocol = true`, a reachable trusted frontend, and valid credentials for a loopback-restricted account.


13) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose messages across virtual host boundaries and cause limited message loss.

The vulnerability exists due to missing authorization in federation upstream URI validation when processing an empty-host direct federation-upstream URI. A remote user can create a crafted federation-upstream configuration and attach a consumer to read and drain messages from another vhost to disclose messages across virtual host boundaries and cause limited message loss.

With the default ack-mode, messages are consumed from the source queue rather than copied. Exploitation requires control of a vhost where the user has policymaker permissions, and queue federation is triggered when a downstream consumer is attached.


14) Inefficient regular expression complexity (CVE-ID: N/A)

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to inefficient regular expression complexity in the rabbitmq_jms_topic_exchange plugin when processing client-supplied JMS selectors during message routing. A remote user can bind an x-jms-topic exchange with an ambiguous LIKE pattern and repeatedly publish matching-shaped header values to cause a denial of service.

The issue affects the optional first-party JMS Topic Exchange plugin and delays publisher confirms while consuming broker CPU on the routing path.


15) LDAP injection (CVE-ID: N/A)

CWE-ID: CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to modify integrity of LDAP-based authentication decisions.

The vulnerability exists due to improper neutralization of special elements used in an LDAP query in the fill/2 function of rabbit_auth_backend_ldap_util.erl when interpolating the username into a DN string for LDAP simple-bind. A remote attacker can supply a specially crafted username containing unescaped DN special characters to modify integrity of LDAP-based authentication decisions.

Only deployments with rabbitmq_auth_backend_ldap enabled and a user_dn_pattern containing ${username} are vulnerable. Exploitation also requires a directory layout where DN-suffix injection resolves to a useful entry.


16) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary script code in the operator's browser.

The vulnerability exists due to cross-site scripting in the stream-connection detail page template when rendering TLS peer-certificate distinguished name fields. A remote attacker can present a certificate with a crafted distinguished name to execute arbitrary script code in the operator's browser.

User interaction is required because an operator must open the stream-connection detail page, and exploitation requires a stream TLS listener configured with peer verification and a trusted certificate containing an attacker-controlled distinguished name.


17) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to bypass intended write permission restrictions and route unroutable messages into an alternate exchange.

The vulnerability exists due to improper access control in the AMQP 1.0 management exchange declaration path when handling HTTP-over-AMQP management requests that declare an exchange with the alternate-exchange argument. A remote privileged user can declare an exchange they can configure and set an unauthorized alternate exchange to bypass intended write permission restrictions and route unroutable messages into that exchange.

Exploitation requires AMQP 1.0 to be enabled and the ability to configure at least one exchange without having write permission on the target alternate exchange.


Remediation

Install update from vendor's website.

References