SB20260918199 - Multiple vulnerabilities in RabbitMQ Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260918199

SB20260918199 - Multiple vulnerabilities in RabbitMQ Server

Published: September 18, 2026

Security Bulletin ID SB20260918199
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Insufficient Session Expiration (CVE-ID: N/A)

CWE-ID: CWE-613 - Insufficient Session Expiration

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose message payloads.

The vulnerability exists due to insufficient session expiration in the RabbitMQ native STOMP adapter when delivering messages to an existing subscription after OAuth JWT expiration. A remote user can retain a STOMP subscription established with a valid JWT past its expiration to disclose message payloads.

The JWT must have read permission for the subscribed queue before it expires.


2) Observable discrepancy (CVE-ID: N/A)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose the existence of vhosts and Stream queues.

The vulnerability exists due to an observable response discrepancy in rabbit_stream_publishers_mgmt when handling Stream Publisher Management API requests for vhosts and queues. A remote user can send requests specifying vhost and Stream queue names to disclose the existence of vhosts and Stream queues.

Exploitation requires a management-tagged user with no permissions on the target vhost.


3) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose virtual-host existence.

The vulnerability exists due to improper access control in the Stream consumer management endpoint when handling GET requests for a virtual host. A remote user can submit a request containing a target virtual-host name to disclose virtual-host existence.

Exploitation requires the Management, Stream, and Stream Management plugins to be enabled.


Remediation

Install update from vendor's website.

References