Security Flaw in RabbitMQ Messaging Broker Affects User Authentication
CVE-2026-67236
8.2HIGH
What is CVE-2026-67236?
A significant vulnerability exists in RabbitMQ that allows unauthorized access to user credentials through improperly configured authentication cookies. When the POST /login endpoint is accessed, the resulting auth cookie may contain base64-encoded login details without appropriate security measures, such as HttpOnly, Secure, SameSite attributes, or expiration settings. This exposes the credentials to potential exploitation via same-origin cross-site scripting attacks or through unauthorized access to the browser's cookie store. Users are advised to upgrade to versions 4.2.8 or 4.3.2 to mitigate this risk.
Affected Version(s)
rabbitmq-server >= 4.2.0, < 4.2.8 < 4.2.0, 4.2.8
rabbitmq-server >= 4.3.0, < 4.3.2 < 4.3.0, 4.3.2