VYPR
advisoryPublished Sep 25, 2026· Updated Sep 27, 2026· 1 source

RabbitMQ: 25 Vulnerabilities Disclosed Together, Highlighting Auth, UI, and DoS Risks

Key findings • 25 RabbitMQ vulnerabilities disclosed on September 25, 2026, span multiple versions and severity levels. • High severity flaws include authentication bypass, XSS in Management …

Key findings

  • 25 RabbitMQ vulnerabilities disclosed on September 25, 2026, span multiple versions and severity levels.
  • High severity flaws include authentication bypass, XSS in Management UI, and DoS via atom exhaustion.
  • Affected components include Management UI, Federation, Shovel, and various protocol handlers.
  • Patches are available across 3.13.x, 4.0.x, 4.1.x, 4.2.x, and 4.3.x maintenance lines.
  • Users are urged to update promptly to mitigate risks associated with these numerous security issues.

On September 25, 2026, a significant batch of 25 vulnerabilities was disclosed for RabbitMQ, a popular messaging and streaming broker. These vulnerabilities, spanning various components and functionalities, range in severity from Low to High, indicating a broad impact on the security posture of affected deployments. The disclosures highlight issues in areas such as the management UI, authentication mechanisms, message routing, and protocol handling.

Several vulnerabilities center around the RabbitMQ Management UI and its handling of user inputs. CVE-2026-67421, a Medium severity vulnerability, details how the management UI could render HTML containing an attacker-controlled queue name when the OAuth management UI was enabled, potentially leading to cross-site scripting (XSS) if an attacker can configure queues. Similarly, CVE-2026-67239, a High severity flaw, describes a Stored XSS vulnerability in the stream-management UI related to TLS peer-certificate Distinguished Names (DNs). Another High severity issue, CVE-2026-67410, reveals that the OAuth2 client secret could be exposed via an unauthenticated JavaScript endpoint when OAuth2 authentication is enabled for the Management UI.

Authentication and authorization mechanisms are also targeted by several CVEs. CVE-2026-67419 (High) involves an authenticated user exploiting consecutive '#' segments in a binding key to bypass topic matcher logic. CVE-2026-67409 (High) points to a Denial of Service (DoS) vulnerability where the JWKS fetch mechanism ignores HTTP response status codes, potentially leading to authentication failures if signing keys cannot be fetched. CVE-2026-67412 (Medium) describes a critical flaw where the Federation upstream skips vhost authorization, allowing unauthorized cross-vhost message access. CVE-2026-67237 (High) details how a bearer token could be inserted into OAuth bootstrap JavaScript without proper escaping, enabling JavaScript execution within the management UI's origin.

Several vulnerabilities relate to resource exhaustion and denial of service. CVE-2026-67408 (High) describes how Stream Management allows low-privilege nodes to be denied service through super-stream binding keys. CVE-2026-67227 (Medium) and CVE-2026-67226 (Medium) highlight atom exhaustion vulnerabilities through the management API, where specific API calls can lead to excessive atom creation, potentially crashing the node. CVE-2026-67225 (Medium) and CVE-2026-67223 (Medium) also touch upon issues with frame handling and user DN patterns, respectively, which could lead to resource exhaustion or unexpected behavior.

Other notable vulnerabilities include CVE-2026-67415 (Medium), where the Shovel parameter parser could convert attacker-controlled runtime parameter values into Erlang atoms, and CVE-2026-67413 (Medium), concerning the rabbitmq_jms_topic_exchange plugin accepting client-controlled binding expressions. CVE-2026-67407 (Medium) is an incomplete fix for a previous vulnerability, allowing for MQTT topic permission bypass.

The affected versions span multiple maintenance lines, including 3.13.x, 4.0.x, 4.1.x, 4.2.x, and 4.3.x, with specific version ranges detailed for each CVE. Patches and fixed versions are available for all disclosed vulnerabilities, with users strongly advised to update to the latest available versions to mitigate these risks.

This coordinated disclosure of 25 vulnerabilities underscores the importance of maintaining up-to-date RabbitMQ instances and regularly reviewing security advisories. Users should prioritize patching, especially for the High severity vulnerabilities affecting authentication, authorization, and UI security.

The batch of vulnerabilities disclosed on September 25, 2026, impacts multiple versions of RabbitMQ, including 3.13.x, 4.0.x, 4.1.x, 4.2.x, and 4.3.x. Specific fixed versions include: 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5 for CVE-2026-67421 and CVE-2026-67420. CVE-2026-67419 is fixed in versions prior to 4.3.5. CVE-2026-67415 and CVE-2026-67413 are fixed in 4.2.10, 4.3.5, and earlier versions like 4.0.24, 4.1.15. CVE-2026-67412, CVE-2026-67409, and CVE-2026-67239 are fixed in 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5. CVE-2026-67411 and CVE-2026-67407 are fixed in 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3. CVE-2026-67408 and CVE-2026-67234 are fixed in 4.3.5, 4.2.10, and 4.1.15. CVE-2026-67242, CVE-2026-67241, and CVE-2026-67223 are fixed in 4.3.3, 4.2.9, 4.1.14, and 4.0.23. CVE-2026-67230, CVE-2026-67225, CVE-2026-67222, and CVE-2026-66073 are fixed in 3.13.15, 4.0.20, 4.1.11, and 4.2.6. CVE-2026-67227 and CVE-2026-67226 are fixed in 4.0.22, 4.1.14, 4.2.7, and 4.3.1. CVE-2026-67237 is fixed in 4.2.8, 4.3.2. CVE-2026-66078 is fixed in 3.13.15, 4.0.20, 4.1.11, and 4.2.6. The advisory for CVE-2026-67223 notes conflicting first-fixed versions for the 3.13, 4.0, and 4.1 lines.

Given the breadth of these vulnerabilities, users are strongly encouraged to consult the official RabbitMQ security advisories for precise version information and patching instructions.

The batch of 25 vulnerabilities disclosed on September 25, 2026, affects multiple RabbitMQ versions, including 3.13.x, 4.0.x, 4.1.x, 4.2.x, and 4.3.x. High severity vulnerabilities include CVE-2026-67419, CVE-2026-67410, CVE-2026-67409, CVE-2026-67408, and CVE-2026-67237, impacting authentication, authorization, and UI security. Several CVEs, such as CVE-2026-67421, CVE-2026-67239, and CVE-2026-67410, highlight risks associated with the RabbitMQ Management UI, including potential XSS and information exposure. Atom exhaustion vulnerabilities (CVE-2026-67227, CVE-2026-67226, CVE-2026-67222, CVE-2026-66073) present a risk of node crashes due to excessive Erlang atom creation. The Federation and Shovel components are affected by CVE-2026-67412 and CVE-2026-67415 respectively, impacting message access control and parameter parsing. Users should update to the latest patched versions, with specific fixes detailed across various maintenance releases for each CVE.

Synthesized by Vypr AI