RabbitMQ Management Plugin EUVD-2026-85625

Requires ALL of the following: (1) the RabbitMQ management plugin is enabled AND configured with the wildcard CORS setting cors_allow_origins = "*" - an explicit, non-default operator misconfiguration; (2) a target administrator has an active, cached HTTP Basic-auth session for the management UI in their browser; and (3) that administrator is socially engineered into visiting an attacker-controlled web page (UI:P/user interaction). Limiting factors: default configurations without wildcard CORS are NOT vulnerable; without a live cached admin session there are no credentials to abuse; and the attack fails if the admin does not visit the malicious page. These constraints substantially narrow real-world exposure despite the network attack vector.

This is a genuine-but-conditional CORS misconfiguration flaw (CWE-942) rather than a raw-network critical. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H) scores 7.6 HIGH, but two metrics tell the real story: AT:P (attack requirements) reflects that a valid admin session must already be cached in the victim's browser, and UI:P requires the administrator to actively visit an attacker-controlled page. Critically, the CVE description also states the wildcard 'cors_allow_origins = "*"' is 'an explicit operator misconfiguration' - this is NOT a default configuration, so the flaw only manifests where an operator has already loosened CORS. PR:N is accurate in that the attacker themselves is unauthenticated (they ride the admin's cached credentials), but exploitation is not opportunistic against arbitrary hosts. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no evidence of active exploitation - status is 'no public exploit identified at time of analysis.' Net: a real, patch-worthy issue for shops that enabled wildcard CORS on the management UI, but the misconfiguration precondition plus required user interaction and a live admin session make widespread untargeted exploitation unlikely. The 'Information Disclosure' tag understates the impact - the primary danger is state-changing (integrity) writes to the management API, which the vector correctly captures as VI:H.

An operator has set the RabbitMQ management plugin to 'cors_allow_origins = "*"'. An administrator who is currently signed into the management UI (HTTP Basic credentials cached in the browser) visits a malicious web page; that page issues cross-origin requests to the management API, and because the handler reflects the attacker's Origin and returns Access-Control-Allow-Credentials: true, the browser attaches the admin's cached credentials and the responses are readable. The attacker thereby performs authenticated, state-changing management operations (e.g., create users, alter permissions) as the administrator. No public exploit code was identified in the provided data.