Skip to main content

RabbitMQ CVE-2026-67236

| EUVDEUVD-2026-87141 HIGH
Cleartext Storage of Sensitive Information (CWE-312)
2026-09-25 GitHub_M
XSS Red Hat Rabbitmq Server Suse Rabbitmq
8.2
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
8.2 HIGH
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.9 MEDIUM

AC:H because credential recovery needs a separate XSS/MITM/local primitive plus a victim login; PR:N/UI:N as the attacker steals a victim's cookie; C:H credential disclosure, no direct integrity/availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Red Hat
5.3 MEDIUM
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
POC Analysis Generated
Sep 25, 2026 - 19:26 vuln.today
Patch available
Sep 25, 2026 - 17:04 EUVD
Analysis Generated
Sep 25, 2026 - 16:51 vuln.today
CVE Published
Sep 25, 2026 - 15:59 cve.org
HIGH 8.2

DescriptionCVE.org

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused is_authorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding rather than encryption, an attacker with same-origin cross-site scripting, an HTTP-readable network position, or local access to the browser cookie store could recover the actual login credentials; older browsers that treated an absent SameSite attribute as None also sent the cookie cross-site. This issue is fixed in versions 4.2.8 and 4.3.2.

AnalysisAI

The RabbitMQ management plugin in versions 4.2.0 through 4.2.8 and 4.3.0 through 4.3.2 writes an 'auth' cookie containing the base64-encoded 'username:password' pair after a successful POST /login, with no HttpOnly, Secure, SameSite, or expiration attributes, so anyone who can read that cookie can trivially decode it back to plaintext administrator credentials. The flaw is not directly exploitable on its own: the attacker must also hold one of three separate primitives - a same-origin cross-site scripting foothold in the management UI, an HTTP-readable network position (cleartext or man-in-the-middle), or local read access to the victim's browser cookie store - which is why the vendor's 8.2 (CVSS 4.0, AT:P/AC:H) score overstates practical risk while the underlying confidentiality impact is high. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires: (1) a victim (typically an administrator) to perform a successful POST /login to the RabbitMQ management plugin, which sets the unprotected base64-encoded 'auth' credential cookie; and (2) the attacker to independently hold ONE of three capabilities - a same-origin cross-site scripting foothold in the management UI, an HTTP-readable network position (cleartext/MITM), or local read access to the victim's browser cookie store. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N, 8.2 HIGH) is largely defensible in structure but the 8.2 magnitude overstates practical risk: the AT:P (attack requirement present) and AC:H metrics correctly encode that this is NOT directly exploitable - an attacker cannot recover credentials without ALSO possessing a separate primitive (a same-origin XSS, a network-readable/MITM position, or local access to the victim's browser cookie store). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade to RabbitMQ 4.2.8 or 4.3.2, which are the vendor-released patched versions referenced in GHSA-88vh-gx85-p36m and tagged at https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.8 and https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.2; the fix removes the credential-bearing 'auth' cookie altogether, so upgrading also invalidates any previously issued copies. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, determine which RabbitMQ deployments run the management plugin and fall in the affected ranges (4.2.0-4.2.8 and 4.3.0-4.3.2); where the plugin is enabled, restrict the management UI to trusted administrative networks, enforce TLS so the auth cookie cannot be read in transit, and treat administrator credentials on those hosts as potentially exposed. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Rabbitmq Server

View all
CVE-2026-57219 HIGH POC
8.7 Jul 10

Sensitive credential disclosure in RabbitMQ affects installations running the management plugin with OAuth 2 configured

CVE-2019-11287 HIGH POC
7.5 Nov 23

Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x ver
CVE-2016-9877 CRITICAL
9.8 Dec 29

An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.
CVE-2025-50200 MEDIUM POC
5.5 Jun 19

RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in
CVE-2026-67404 CRITICAL
9.2 Sep 23

RabbitMQ brokers that use the OAuth2 plugin can silently fall back to disabled TLS certificate verification when no CA b
CVE-2026-67231 CRITICAL
9.1 Sep 23

TLS client-authentication bypass in the RabbitMQ trust-store plugin lets a remote unauthenticated attacker whose forged

CVE-2026-67409 HIGH
8.2 Sep 25

Authentication denial of service in RabbitMQ affects deployments running the rabbitmq_auth_backend_oauth2 plugin from 3.
CVE-2026-67410 HIGH
8.2 Sep 25

OAuth2 client secret disclosure in the RabbitMQ Management UI affects versions 4.2.0 through 4.2.8 and 4.3.0 through 4.3
CVE-2026-67232 HIGH
8.2 Sep 23

Memory-exhaustion denial of service in RabbitMQ's Web-MQTT plugin (rabbitmq_web_mqtt) lets an unauthenticated remote att
CVE-2017-4966 HIGH
7.8 Jun 13

An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions p
CVE-2021-22117 HIGH
7.8 May 18

RabbitMQ installers on Windows prior to version 3.8.16 do not harden plugin directory permissions, potentially allowing

CVE-2026-67239 HIGH
7.6 Sep 25

Stored cross-site scripting (XSS) in the RabbitMQ stream management UI allows an attacker who can present a trusted TLS

Same weakness CWE-312 – Cleartext Storage of Sensitive Information

View all
CVE-2023-22894 MEDIUM POC
4.9
CVE-2025-22896 CRITICAL POC
9.2
CVE-2023-31069 CRITICAL POC
9.8
CVE-2022-26148 CRITICAL POC
9.8
CVE-2021-29954 CRITICAL POC
9.8
CVE-2020-5723 CRITICAL POC
9.8
CVE-2019-19228 CRITICAL POC
9.8
CVE-2019-13096 CRITICAL POC
9.8

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected

Share

CVE-2026-67236 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy