Vulnerability Description
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI was enabled. Exploitation requires an attacker with queue configure permission, a management administrator who can see but cannot read that queue, and the administrator clicking Get Message(s). A queue name containing a base element can then retarget the automatic relative refresh because the Content Security Policy omits base-uri and connect-src, and an attacker endpoint that permits the management origin through CORS can receive the victim's Authorization header. This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Broadcom | Rabbitmq Server | >= 3.13.0, < 3.13.9 |
Related Weaknesses (CWE)
References
- https://github.com/rabbitmq/rabbitmq-server/commit/ff595eaaa6d4f580f72fa04801ffdPatch
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.5Release Notes
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-6256-27fm-4ExploitVendor Advisory
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-6256-27fm-4ExploitVendor Advisory
FAQ
What is CVE-2026-67421?
CVE-2026-67421 is a vulnerability with a CVSS score of 6.8 (MEDIUM). RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reason containing an attacker-contr...
How severe is CVE-2026-67421?
CVE-2026-67421 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-67421?
Check the references section above for vendor advisories and patch information. Affected products include: Broadcom Rabbitmq Server.