Stored XSS Vulnerability in RabbitMQ Messaging Broker Impacting Stream Management UI
CVE-2026-67239
What is CVE-2026-67239?
This vulnerability in RabbitMQ allows for stored cross-site scripting (XSS) through the TLS peer-certificate distinguished name (DN) in the stream management user interface. Specifically, certain lines in the UI render user input without proper sanitization, enabling an attacker to exploit the feature if specific configurations are in place. To execute the attack, the adversary must possess a maliciously crafted certificate that is trusted by the configured TLS listener. The vulnerability has been officially addressed in subsequent releases, with recommendations for immediate upgrading to mitigate risks.
Affected Version(s)
rabbitmq-server >= 3.13.0, < 3.13.18 < 3.13.0, 3.13.18
rabbitmq-server >= 4.0.0, < 4.0.23 < 4.0.0, 4.0.23
rabbitmq-server >= 4.1.0, < 4.1.14 < 4.1.0, 4.1.14