Cross-Site Scripting Vulnerability in RabbitMQ Management UI
CVE-2026-66077

7.3HIGH

Key Information:

Vendor

RabbitMQ

Status
RabbitMQ-server
Vendor
CVE Published:
23 September 2026

What is CVE-2026-66077?

A cross-site scripting vulnerability exists in the management UI of RabbitMQ. Prior to specific versions, it fails to HTML-escape user-controlled input, allowing an attacker with a valid TLS client certificate to inject malicious scripts. If the attacker can obtain a certificate signed by a trusted CA and the management UI is viewed by an administrator, it can lead to full account takeover. This security flaw particularly affects deployments with mutual TLS (mTLS) enabled for client authentication, thus posing a significant risk if not mitigated. The issue has been addressed in newer RabbitMQ releases.

Affected Version(s)

rabbitmq-server >= 3.13.0, < 3.13.15 < 3.13.0, 3.13.15

rabbitmq-server >= 4.0.0, < 4.0.20 < 4.0.0, 4.0.20

rabbitmq-server >= 4.1.0, < 4.1.11 < 4.1.0, 4.1.11

References

https://github.com/rabbitmq/rabbitmq-server/security/advi...
x_refsource_CONFIRM
https://github.com/rabbitmq/rabbitmq-server/releases/tag/...
x_refsource_MISC

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.