EUVD-2026-87146Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess RabbitMQ management UI
-
ExploitTrigger auth-mechanism cookie clear on logout
-
ExecutionMalformed non-ASCII cookie not deleted
-
ImpactStale auth preference persists across login
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Affects RabbitMQ management plugin's OAuth bootstrap (rabbit_mgmt_oauth_bootstrap.erl) in versions 4.2.0 through 4.2.7 and 4.3.0/4.3.1, where get_auth_mechanism/1 clears the strict_auth_mechanism or preferred_auth_mechanism cookie. Manifestation requires the management UI to be in use and a logout/login cycle to occur so the malformed cookie-clearing occurs; it depends on browser behavior of refusing to delete a cookie whose name violates RFC 6265. Limiting factors: impact is confined to stale UI authentication-mechanism preferences, there is no confidentiality or availability impact, user interaction is required (UI:P), and it is fixed in 4.2.8 and 4.3.2. |
| Impact | This is a genuinely low-priority, low-severity issue and the NVD CVSS 4.0 base score of 2.3 is consistent with the description. The vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N) reflects a network-facing management UI issue that requires user interaction (a logout/login cycle) and an additional attack requirement (AT:P), with only a Low integrity impact and no confidentiality or availability impact. The vendor advisory (GHSA-q286-p3m9-j69f) is explicit that the flaw is NOT exploitable for code execution or data exfiltration - its only effect is that a non-ASCII cookie name (produced by term_to_binary/1 on an atom, violating RFC 6265) may prevent the browser from deleting a stored auth-mechanism preference, leaving a stale preference across sessions. No EPSS score, no CISA KEV listing, and no public proof-of-concept are present in the input, so there is no evidence of exploitation interest. NOTE THE CONFLICT: the input Tags include 'RCE', which directly contradicts both the description and the advisory - this is a mislabeling, not a real remote-code-execution risk, and the tag should not drive prioritization. |
| Exploit ScenarioDerived | There is no meaningful attacker-driven scenario: the bug manifests as the RabbitMQ management UI writing a malformed (non-ASCII-named) cookie when clearing the strict_auth_mechanism/preferred_auth_mechanism preference, which the browser then fails to delete. The practical consequence is that a user's previously selected authentication-mechanism preference persists across logout and subsequent login rather than being cleared. No public exploit is identified at time of analysis, and the vendor states it cannot be leveraged for code execution or data theft. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Stale OAuth authentication-mechanism preferences can survive a logout in the RabbitMQ management UI on versions 4.2.0 through 4.2.7 and 4.3.0/4.3.1, because the plugin emits a non-ASCII cookie name when it tries to clear the strict_auth_mechanism or preferred_auth_mechanism cookie, and RFC 6265-compliant browsers refuse to delete a cookie whose name is not a valid token. The practical effect is limited to a persisted UI preference carrying across logout/login cycles; there is no code execution, data exfiltration, or confidentiality or availability impact, which is consistent with the NVD CVSS 4.0 base score of 2.3 and with the independent CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N assessment. Exploitation requires the management UI to be in active use and a logout/login cycle to occur, and no public exploit code or evidence of active exploitation was identified at time of analysis.
RemediationAI
Vendor-released patch: RabbitMQ 4.2.8 or 4.3.2 - upgrade to either version (or later) to resolve the issue; the two upstream commits (149cb59d618cefa83c6deb02dbbb1e8a7a2bc968, baac0aaf170efeb4f124ee36b8417274fa8dcc1a) replace term_to_binary/1 with atom_to_binary/1 in rabbit_mgmt_oauth_bootstrap.erl, and release notes are at https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.8 and https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.2, with the advisory at https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-q286-p3m9-j69f. Where an immediate upgrade is not possible, the practical compensating control is manual cookie hygiene rather than a configuration toggle: instruct affected users of the management UI to delete the strict_auth_mechanism and preferred_auth_mechanism cookies for the management host via browser developer tools after logout (trade-off: manual, per-user, and easy to forget), or to use a fresh private/incognito window or a distinct browser profile for each login (trade-off: inconvenient and not enforceable centrally). Restricting access to the management UI to trusted networks and disabling the OAuth bootstrap flow if it is not required reduces exposure to the affected code path, at the cost of losing that login mode; note that these are exposure-reduction measures only and do not repair the malformed cookie-clearing logic. Because the residual impact is a stale authentication-mechanism preference with no confidentiality or availability effect, remediation can be scheduled at normal maintenance priority - no emergency change process is warranted.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in the RabbitMQ management plugin's OAuth bootstrap module (deps/rabbitmq_management/src/rabbit_mgmt_oauth_bootstrap.erl), an Erlang/OTP component served through the Cowboy HTTP stack that handles the management UI's OAuth login flow. In the vulnerable code path, get_auth_mechanism/1 called term_to_binary/1 on the strict_auth_mechanism or preferred_auth_mechanism atom when constructing the response cookie used to clear that preference; term_to_binary/1 produces an Erlang external term format binary (starting with the 131/0x83 version tag and containing non-ASCII bytes) rather than a human-readable name, so the resulting Set-Cookie header carries a cookie name that violates the RFC 6265 token grammar. Since browsers silently ignore cookie-setting or expiry directives that use invalid names, the deletion never takes effect and the old preference stays in the jar. The fix swaps term_to_binary/1 for atom_to_binary/1, yielding an ASCII cookie name that browsers will accept and expire. Classified as CWE-20 (Improper Input Validation) - more precisely, incorrect serialization of an internal atom for an external HTTP protocol field - the issue is a data-integrity/preference-persistence defect rather than a memory-safety or injection primitive; note that third-party tags attached to this record reference "RCE", which is not supported by the vendor description, the commit diff, or the independent assessment, and should not be taken as an exploitation signal.
Know when Rabbitmq gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Network-facing management UI but requires a logout/login user interaction and browser-specific cookie handling (AC:H, UI:R); only minor integrity impact (stale preference), no confidentiality or availability effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, get_auth_mechanism/1 used term_to_binary/1 on the strict_auth_mechanism or preferred_auth_mechanism atom when clearing the corresponding cookie, producing a non-ASCII cookie name that violates RFC 6265 and can prevent the browser from deleting the preference. The issue is not directly exploitable for code execution or data exfiltration; its security relevance is limited to stale authentication-mechanism preferences persisting across logout and login cycles. This issue is fixed in versions 4.2.8 and 4.3.2.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Sensitive credential disclosure in RabbitMQ affects installations running the management plugin with OAuth 2 configured
Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x ver
Denial of service in the RabbitMQ Java client library (com.rabbitmq:amqp-client ≤ 5.30.0) allows a malicious or compromi
An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.
Parsing desynchronization in the RabbitMQ amqp091-go AMQP 0.9.1 client library before 1.13.0 lets a malicious or comprom
RabbitMQ's amqp091-go Go client library, in all versions before 1.13.0, builds TLS configuration from amqps:// URIs with
RabbitMQ is a multi-protocol messaging broker. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploita
RabbitMQ brokers that use the OAuth2 plugin can silently fall back to disabled TLS certificate verification when no CA b
Silent AMQP 0.9.1 metadata corruption in the RabbitMQ amqp091-go Go client library prior to 1.13.0 lets an application t
TLS client-authentication bypass in the RabbitMQ trust-store plugin lets a remote unauthenticated attacker whose forged
TLS certificate validation is completely bypassed in the RabbitMQ Java client library (`com.rabbitmq:amqp-client`) prior
Denial of service in the official RabbitMQ Go client library amqp091-go (versions prior to 1.13.0): a malicious, comprom
Exploit-DB