SB2026073107 - Fedora 43 update for rabbitmq-server
Published: July 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 vulnerabilities.
1) Stored cross-site scripting (CVE-ID: CVE-2026-44839)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper neutralization of script-related html tags in a web page in the management UI pages that list virtual hosts when rendering unsanitized virtual host names in restart forms. A remote privileged user can create a crafted virtual host name and force the virtual host to restart to disclose sensitive information.
User interaction is required because a victim must visit the page of the malicious virtual host.
2) Improper access control (CVE-ID: CVE-2026-57215)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote user to inject messages into another tenant's reply channel and cause silent routing loss conditions.
The vulnerability exists due to improper access control in direct-reply-to binding handling when binding and unbinding volatile amq.rabbitmq.reply-to.* destinations. A remote user can create and retain a crafted binding to inject messages into another tenant's reply channel and cause silent routing loss conditions.
Exploitation requires normal bind and publish permissions in a shared virtual host.
3) Input validation error (CVE-ID: CVE-2026-57212)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in the management HTTP API when handling oversized request bodies. A remote attacker can send a specially crafted request body to cause a denial of service.
4) Missing Authorization (CVE-ID: CVE-2026-57221)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to missing authorization in passive queue.declare and passive exchange.declare operations when handling authenticated AMQP requests within a virtual host. A remote user can issue passive declare operations to disclose sensitive information.
Even users with empty configure, write, and read permission regexes can enumerate queue and exchange names, and passive queue declarations also expose message counts and consumer counts.
5) Information disclosure (CVE-ID: CVE-2026-57219)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to exposure of sensitive information in the HTTP API endpoint GET /api/auth when handling unauthenticated requests on affected OAuth 2 configurations. A remote attacker can send a request to the endpoint to disclose sensitive information.
Only installations with the management plugin enabled and OAuth 2 configured to use the management.oauth_client_secret setting are vulnerable.
6) Cross-site scripting (CVE-ID: CVE-2026-57213)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear
The vulnerability allows a remote user to execute arbitrary script code in a user's browser.
The vulnerability exists due to cross-site scripting in the federation management plugin when rendering an unsanitized consumer_tag. A remote user can inject a crafted consumer_tag value to execute arbitrary script code in a user's browser.
Remediation
Install update from vendor's website.