CVE-2026-67237
rabbitmq-server: rabbitmq-server: Cross-site scripting via unescaped OAuth token injection
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD, Bitnami. Rated lower by Red Hat (medium), Ubuntu (medium).
Description
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorization header or access_token cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token content to execute JavaScript in the management UI origin. The endpoint is exposed before authentication only when management.oauth_enabled is true, and exploitation through the cookie path additionally requires the attacker to plant an access_token cookie on the management host. This issue is fixed in versions 4.2.8 and 4.3.2.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | rabbitmq | 4.2.8, 4.3.2 |
| debian 11 | rabbitmq-server | no fix listed |
| debian 14 | rabbitmq-server | 4.3.2-1 |
| rapidfort debian 12 | rabbitmq-server | 0:4.3.2-1 |
| rapidfort debian 13 | rabbitmq-server | 0:4.3.2-1 |
| rapidfort ubuntu 20.04 | rabbitmq-server | 0:3.12.1-1ubuntu1.7, 0:3.9.27-0ubuntu0.6, 0:4.0.5-10ubuntu5.2 |
| rapidfort ubuntu 22.04 | rabbitmq-server | 0:3.12.1-1ubuntu1.7, 0:3.9.27-0ubuntu0.6, 0:4.0.5-10ubuntu5.2 |
| rapidfort ubuntu 24.04 | rabbitmq-server | 0:3.12.1-1ubuntu1.7, 0:3.9.27-0ubuntu0.6, 0:4.0.5-10ubuntu5.2 |
| Red Hat | rabbitmq-server | no fix listed |
| ubuntu 18.04-ESM | rabbitmq-server | 3.6.10-1ubuntu0.5+esm1 |
| ubuntu 20.04-ESM | rabbitmq-server | 3.8.3-0ubuntu0.3+esm2 |
| ubuntu 22.04 | rabbitmq-server | 3.9.27-0ubuntu0.6 |
Show all 14 entries from 14 sources
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | rabbitmq | 4.2.8, 4.3.2 |
| debian 11 | rabbitmq-server | no fix listed |
| debian 14 | rabbitmq-server | 4.3.2-1 |
| rapidfort debian 12 | rabbitmq-server | 0:4.3.2-1 |
| rapidfort debian 13 | rabbitmq-server | 0:4.3.2-1 |
| rapidfort ubuntu 20.04 | rabbitmq-server | 0:3.12.1-1ubuntu1.7, 0:3.9.27-0ubuntu0.6, 0:4.0.5-10ubuntu5.2 |
| rapidfort ubuntu 22.04 | rabbitmq-server | 0:3.12.1-1ubuntu1.7, 0:3.9.27-0ubuntu0.6, 0:4.0.5-10ubuntu5.2 |
| rapidfort ubuntu 24.04 | rabbitmq-server | 0:3.12.1-1ubuntu1.7, 0:3.9.27-0ubuntu0.6, 0:4.0.5-10ubuntu5.2 |
| Red Hat | rabbitmq-server | no fix listed |
| ubuntu 18.04-ESM | rabbitmq-server | 3.6.10-1ubuntu0.5+esm1 |
| ubuntu 20.04-ESM | rabbitmq-server | 3.8.3-0ubuntu0.3+esm2 |
| ubuntu 22.04 | rabbitmq-server | 3.9.27-0ubuntu0.6 |
| ubuntu 24.04 | rabbitmq-server | 3.12.1-1ubuntu1.7 |
| ubuntu 26.04 | rabbitmq-server | 4.0.5-10ubuntu5.2 |
References
- https://access.redhat.com/security/cve/CVE-2026-67237
- https://github.com/rabbitmq/rabbitmq-server/commit/5cd6d841d84450324a4613501ed917d98828af23
- https://github.com/rabbitmq/rabbitmq-server/commit/a8041d528c1a71af4cb75ade247ed082fe6b83fb
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.8
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.2
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-2rf7-f6r6-8rwh
- https://nvd.nist.gov/vuln/detail/CVE-2026-67237
- https://ubuntu.com/security/notices/USN-8933-1