SB2026103124 - Ubuntu update for rabbitmq-server
Published: October 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 12 vulnerabilities.
1) Overly permissive cross-domain whitelist (CVE-ID: CVE-2026-66070)
CWE-ID: CWE-942 - Overly Permissive Cross-domain Whitelist
CVSSv4: 8.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to issue authenticated, state-changing requests to the management API and compromise confidentiality and integrity.
The vulnerability exists due to permissive cross-domain security policy with untrusted domains in rabbit_mgmt_cors.erl when handling cross-origin requests with a wildcard CORS origin configuration. A remote attacker can host a malicious web page that causes a signed-in administrator's browser to send authenticated requests to compromise confidentiality and integrity.
User interaction is required, and exploitation depends on the management plugin being configured with cors_allow_origins = "*" and a target administrator having cached HTTP Basic credentials in the browser.
2) Cross-site scripting (CVE-ID: CVE-2026-66077)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to execute arbitrary JavaScript in an administrator's browser session and take over the administrator account.
The vulnerability exists due to cross-site scripting in the management UI connection detail templates when rendering TLS peer certificate subject or issuer fields. A remote user can connect with a specially crafted CA-signed client certificate and cause an administrator to view the connection details page to execute arbitrary JavaScript in an administrator's browser session and take over the administrator account.
Exploitation requires a TLS listener configured with peer verification, the ability to obtain a trusted client certificate with attacker-controlled subject data, and administrator interaction with the connection detail page.
3) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-66079)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the amqp10_binary_parser array32 parser when parsing a crafted pre-authentication AMQP 1.0 SASL-init frame. A remote attacker can send a specially crafted frame to cause a denial of service.
Only nodes with the AMQP 1.0 listener enabled are vulnerable, and all tenants and protocols on the affected node lose service when the Erlang VM terminates.
4) Improper Certificate Validation (CVE-ID: CVE-2026-67231)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass TLS client authentication.
The vulnerability exists due to improper certificate validation in the rabbitmq_trust_store verify_fun when handling a presented client certificate during the TLS handshake. A remote attacker can present a forged self-signed certificate with a matching issuer distinguished name and serial number to bypass TLS client authentication.
Exploitation requires the trust-store plugin to be enabled and used as the TLS verify function, and requires knowledge of the issuer and serial number of a whitelisted certificate.
5) Improper handling of highly compressed data (CVE-ID: CVE-2026-67232)
CWE-ID: CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of highly compressed data in the rabbit_web_mqtt_handler WebSocket handling path when processing a highly compressed WebSocket frame with permessage-deflate enabled. A remote attacker can send a specially crafted compressed WebSocket frame to cause a denial of service.
Only systems with the rabbitmq_web_mqtt plugin enabled are vulnerable.
6) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-67235)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the AMQP 0-9-1 body assembly logic when processing published message body fragments after a crafted content-header declares an excessive BodySize. A remote user can send a specially crafted sequence of AMQP 0-9-1 publish frames to cause a denial of service.
Exploitation requires publish permission over AMQP 0-9-1.
7) Cleartext storage of sensitive information (CVE-ID: CVE-2026-67236)
CWE-ID: CWE-312 - Cleartext Storage of Sensitive Information
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to cleartext storage of sensitive information in the management UI login cookie when processing successful POST /login requests. A remote attacker can obtain the auth cookie value to disclose sensitive information.
The cookie stores the user's actual username and password in base64 form rather than a session token, and it is readable from JavaScript because it is set without the HttpOnly attribute.
8) Cross-site scripting (CVE-ID: CVE-2026-67237)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary JavaScript in the management UI origin.
The vulnerability exists due to cross-site scripting in the OAuth bootstrap JavaScript endpoint set_token_auth/2 when emitting JavaScript from an attacker-influenced bearer token or access_token cookie. A remote attacker can supply a crafted token value to execute arbitrary JavaScript in the management UI origin.
Only deployments with OAuth enabled are exposed, and user interaction is required for the victim's browser to fetch bootstrap.js. Exploitation requires the ability to plant an access_token cookie on the management host, while the Authorization header path is reachable from a non-browser client that mediates an attacker-controlled request.
9) Resource exhaustion (CVE-ID: CVE-2026-67238)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in rabbit_pid_codec:decompose_from_binary/1 when decoding caller-supplied ETF-encoded reply-to queue names. A remote user can send specially crafted AMQP requests with unique node names to cause a denial of service.
The issue is reachable through queue names or routing keys beginning with amq.rabbitmq.reply-to. and can crash the entire Erlang VM across all vhosts and connections.
10) Cross-site scripting (CVE-ID: CVE-2026-67239)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary script code in the operator's browser.
The vulnerability exists due to cross-site scripting in the stream-connection detail page template when rendering TLS peer-certificate distinguished name fields. A remote attacker can present a certificate with a crafted distinguished name to execute arbitrary script code in the operator's browser.
User interaction is required because an operator must open the stream-connection detail page, and exploitation requires a stream TLS listener configured with peer verification and a trusted certificate containing an attacker-controlled distinguished name.
11) Improper Certificate Validation (CVE-ID: CVE-2026-67404)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to forge JWKS responses and cause the broker to accept arbitrary JWTs.
The vulnerability exists due to improper certificate validation in ssl_options/1 when fetching JWKS data with no CA bundle available. A remote attacker can perform a man-in-the-middle attack to forge JWKS responses and cause the broker to accept arbitrary JWTs.
The issue requires the OAuth2 plugin to be in use with no cacertfile configured and an empty or unreadable OS CA bundle.
12) Unchecked Return Value (CVE-ID: CVE-2026-67409)
CWE-ID: CWE-252 - Unchecked Return Value
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to unchecked return value in the JWKS key fetching mechanism in uaa_jwt.erl when processing JWKS endpoint responses during signing key refresh. A remote attacker can send a crafted JWT with an unknown kid value to cause a denial of service.
Exploitation requires RabbitMQ to be configured with OAuth2 authentication using JWKS-based key discovery, and the JWKS endpoint must return an error response with a valid JSON body that lacks a keys field.
Remediation
Install update from vendor's website.