CVE-2026-67421 RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling
An attacker with queue configure permission can inject HTML into the RabbitMQ Management UI to steal administrator credentials via OAuth token leakage.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-67421?
CVE-2026-67421 is a medium-severity cross-site scripting vulnerability in Broadcom Rabbitmq Server, published on 25 Sep 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI was enabled. Exploitation requires an attacker with queue configure permission, a management administrator who can see but cannot read that queue, and the administrator clicking Get Message(s). A queue name containing a base element can then retarget the automatic relative refresh because the Content Security Policy omits base-uri and connect-src, and an attacker endpoint that permits the management origin through CORS can receive the victim's Authorization header. This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.
Weakness: CWE-862
Which versions are affected by CVE-2026-67421?
1 open source package ship an affected version, including rabbitmq. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rabbitmq Bitnami | From 3.13.0 | 3.13.19, 4.0.24, 4.1.15, 4.2.10, 4.3.5 |
Products include Broadcom Rabbitmq Server.
How do I fix CVE-2026-67421?
Upgrade rabbitmq to a fixed version for your release line: 3.13.19, 4.0.24, 4.1.15 or 4.2.10.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-67421 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-67421 exists.
Other vulnerabilities in Broadcom Rabbitmq Server
- CVE-2016-9877 Auth bypass in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6; RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12 and 1.7.x before 1.7.7
- CVE-2026-67404 RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch
- CVE-2026-67231 RabbitMQ: Trust-store whitelist by Issuer+Serial only
- CVE-2026-57219 Information disclosure in rabbitmq-server
- CVE-2026-67236 RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login
Sources
Also known as AZL-105323, BIT-rabbitmq-2026-67421, DEBIAN-CVE-2026-67421, GHSA-6256-27fm-4rgr, UBUNTU-CVE-2026-67421.