CVE-2016-9877 Auth bypass in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6; RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12 and 1.7.x before 1.7.7
Attackers can bypass MQTT authentication by omitting the password, gaining unauthorized access to the RabbitMQ message broker.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-9877?
CVE-2016-9877 is a critical authentication bypass vulnerability in Broadcom Rabbitmq Server, published on 29 Dec 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.
Weakness: CWE-284
Which versions are affected by CVE-2016-9877?
It affects 2 products.
Products include Broadcom Rabbitmq Server, Pivotal Software Rabbitmq.
How do I fix CVE-2016-9877?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2016-9877 being exploited?
There is no known exploitation of CVE-2016-9877 in the wild and no public exploit code.
Other vulnerabilities in Broadcom Rabbitmq Server
- CVE-2026-67404 RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch
- CVE-2026-67231 RabbitMQ: Trust-store whitelist by Issuer+Serial only
- CVE-2026-57219 Information disclosure in rabbitmq-server
- CVE-2026-67236 RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login
- CVE-2026-67409 RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS
Sources
Also known as DEBIAN-CVE-2016-9877, DSA-3761-1, GHSA-fjmp-8qvg-p73x, UBUNTU-CVE-2016-9877, USN-3374-1, openSUSE-SU-2024:11294-1.