SB2026081823 - Multiple vulnerabilities in RabbitMQ Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081823

SB2026081823 - Multiple vulnerabilities in RabbitMQ Server

Published: August 18, 2026

Security Bulletin ID SB2026081823
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 9
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 11% Low 89%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 9 vulnerabilities.


1) Insufficiently protected credentials (CVE-ID: N/A)

CWE-ID: CWE-522 - Insufficiently Protected Credentials

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive credentials.

The vulnerability exists due to insufficiently protected credentials in the shovel management HTTP API endpoint GET /api/shovels/vhost/{vhost}/{name} when returning stored dynamic shovel definitions. A remote user can send a request to the per-shovel management endpoint to disclose sensitive credentials.

Only instances with rabbitmq_shovel and rabbitmq_shovel_management enabled are vulnerable. The issue affects dynamic shovels whose URIs embed credentials and that are in a reporting state so they appear in shovel status.


2) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the STOMP frame size handling in rabbit_stomp_reader.erl when processing unauthenticated STOMP connections. A remote attacker can send oversized STOMP frames over many concurrent unauthenticated connections to cause a denial of service.

The intended 64 KB frame limit for unauthenticated connections is defined but not enforced, and the risk increases with many concurrent unauthenticated connections.


3) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary BEAM function calls.

The vulnerability exists due to improper access control in the federation-management restart resource when handling crafted federation restart requests for nonmember Erlang nodes. A remote user can send concurrent crafted requests that trigger nonmember RPC calls and reflect distribution handshake digests to execute arbitrary BEAM function calls.

Exploitation requires valid management credentials with the policymaker tag, permission for the selected vhost, the rabbitmq_federation and rabbitmq_federation_management plugins enabled, broker reachability to attacker-controlled EPMD and distribution ports, and the tested OTP 27 handshake behavior.


4) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper access control in the RabbitMQ management HTTP API and Erlang distribution handling when processing administrator-authenticated global-parameter and reset requests that trigger outbound distribution handshakes to attacker-controlled nodes. A remote privileged user can send specially crafted management API requests and reflect distribution authentication responses to execute arbitrary code.

Exploitation requires valid management credentials with the administrator tag, reachable management reset and global-parameter routes, broker resolution of an attacker-controlled hostname, and broker egress to attacker-controlled EPMD and distribution ports.


5) Improper access control (CVE-ID: CVE-2026-67420)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to publish messages with a foreign AMQP user_id after that privilege should have been revoked.

The vulnerability exists due to improper access control in rabbit_access_control:update_state/2 and rabbit_access_control:check_user_id/2 when refreshing an existing AMQP connection from an OAuth token that no longer grants the impersonator tag. A remote user can refresh the connection with a same-username token that omits the impersonator tag to publish messages with a foreign AMQP user_id after that privilege should have been revoked.

Only connections that previously held the impersonator tag are affected. The issue requires a refresh-capable OAuth backend for AMQP, a successful credential refresh before the original credential-expiry timer closes the connection, and it affects both existing and newly opened channels on the refreshed connection.


6) Input validation error (CVE-ID: CVE-2026-67418)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper input validation in the MQTT 5 property parser and outbound PUBLISH property serializer when processing a crafted MQTT 5 PUBLISH packet containing an inapplicable property. A remote user can send a specially crafted PUBLISH message to cause a denial of service.

MQTT or Web MQTT must be enabled, and exploitation requires a separately authenticated MQTT 5 or Web MQTT subscriber on a matching topic or subscription filter.


7) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-67419)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in the topic exchange routing matcher when processing binding keys with consecutive `#` wildcard segments and comparable-depth routing keys. A remote user can declare a queue binding with adjacent `#` segments and publish a matching routing key to cause a denial of service.

The issue can allocate a large intermediate duplicate destination list before deduplication, and user interaction is not required.


8) Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CVE-ID: CVE-2026-67421)

CWE-ID: CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information and perform unauthorized administrative actions.

The vulnerability exists due to improper output neutralization for html in RabbitMQ Management OAuth error handling when rendering an AMQP authorization-error reason in the OAuth management UI. A remote user can create a queue with a crafted html name and induce a management administrator to click Get Message(s) to disclose sensitive information and perform unauthorized administrative actions.

The issue is exploitable only when the OAuth management UI is enabled, the victim can see the queue but lacks AMQP read permission for it, automatic UI refresh remains active, and user interaction is required.


9) Interpretation Conflict (CVE-ID: N/A)

CWE-ID: CWE-436 - Interpretation Conflict

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to spoof the publisher identity presented to consumers.

The vulnerability exists due to interpretation conflict in the AMQP 1.0 server parser and message conversion path when processing AMQP 1.0 messages with a properties section placed after the first body section. A remote user can publish a specially crafted message with a forged late user-id to spoof the publisher identity presented to consumers.

Exploitation requires the ability to authenticate over AMQP 1.0, write to the target exchange or queue, and reach consumers that accept out-of-order sections or consume the message through a cross-protocol conversion path. Consumers that rely on the message user-id as an authenticated identity signal are affected.


Remediation

Install update from vendor's website.

References