CVE-2026-67237
rabbitmq-server: rabbitmq-server: Cross-site scripting via unescaped OAuth token injection
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Bitnami. Más baja según Red Hat (media), Ubuntu (media).
Descripción
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorization header or access_token cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token content to execute JavaScript in the management UI origin. The endpoint is exposed before authentication only when management.oauth_enabled is true, and exploitation through the cookie path additionally requires the attacker to plant an access_token cookie on the management host. This issue is fixed in versions 4.2.8 and 4.3.2.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | rabbitmq | 4.2.8, 4.3.2 |
| debian 11 | rabbitmq-server | sin corrección indicada |
| debian 14 | rabbitmq-server | 4.3.2-1 |
| rapidfort debian 12 | rabbitmq-server | 0:4.3.2-1 |
| rapidfort debian 13 | rabbitmq-server | 0:4.3.2-1 |
| rapidfort ubuntu 20.04 | rabbitmq-server | 0:3.12.1-1ubuntu1.7, 0:3.9.27-0ubuntu0.6, 0:4.0.5-10ubuntu5.2 |
| rapidfort ubuntu 22.04 | rabbitmq-server | 0:3.12.1-1ubuntu1.7, 0:3.9.27-0ubuntu0.6, 0:4.0.5-10ubuntu5.2 |
| rapidfort ubuntu 24.04 | rabbitmq-server | 0:3.12.1-1ubuntu1.7, 0:3.9.27-0ubuntu0.6, 0:4.0.5-10ubuntu5.2 |
| Red Hat | rabbitmq-server | sin corrección indicada |
| ubuntu 18.04-ESM | rabbitmq-server | 3.6.10-1ubuntu0.5+esm1 |
| ubuntu 20.04-ESM | rabbitmq-server | 3.8.3-0ubuntu0.3+esm2 |
| ubuntu 22.04 | rabbitmq-server | 3.9.27-0ubuntu0.6 |
Mostrar las 14 entradas de 14 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | rabbitmq | 4.2.8, 4.3.2 |
| debian 11 | rabbitmq-server | sin corrección indicada |
| debian 14 | rabbitmq-server | 4.3.2-1 |
| rapidfort debian 12 | rabbitmq-server | 0:4.3.2-1 |
| rapidfort debian 13 | rabbitmq-server | 0:4.3.2-1 |
| rapidfort ubuntu 20.04 | rabbitmq-server | 0:3.12.1-1ubuntu1.7, 0:3.9.27-0ubuntu0.6, 0:4.0.5-10ubuntu5.2 |
| rapidfort ubuntu 22.04 | rabbitmq-server | 0:3.12.1-1ubuntu1.7, 0:3.9.27-0ubuntu0.6, 0:4.0.5-10ubuntu5.2 |
| rapidfort ubuntu 24.04 | rabbitmq-server | 0:3.12.1-1ubuntu1.7, 0:3.9.27-0ubuntu0.6, 0:4.0.5-10ubuntu5.2 |
| Red Hat | rabbitmq-server | sin corrección indicada |
| ubuntu 18.04-ESM | rabbitmq-server | 3.6.10-1ubuntu0.5+esm1 |
| ubuntu 20.04-ESM | rabbitmq-server | 3.8.3-0ubuntu0.3+esm2 |
| ubuntu 22.04 | rabbitmq-server | 3.9.27-0ubuntu0.6 |
| ubuntu 24.04 | rabbitmq-server | 3.12.1-1ubuntu1.7 |
| ubuntu 26.04 | rabbitmq-server | 4.0.5-10ubuntu5.2 |
Referencias
- https://access.redhat.com/security/cve/CVE-2026-67237
- https://github.com/rabbitmq/rabbitmq-server/commit/5cd6d841d84450324a4613501ed917d98828af23
- https://github.com/rabbitmq/rabbitmq-server/commit/a8041d528c1a71af4cb75ade247ed082fe6b83fb
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.8
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.2
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-2rf7-f6r6-8rwh
- https://nvd.nist.gov/vuln/detail/CVE-2026-67237
- https://ubuntu.com/security/notices/USN-8933-1