CVE-2026-57213: Broadcom RabbitMQ Server XSS Vulnerability

CVE-2026-57213 Overview

CVE-2026-57213 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in the rabbitmq_federation_management plugin of Broadcom RabbitMQ Server. The plugin renders the consumer_tag field on the Federation Status page without HTML escaping. An authenticated user who can configure a federation upstream or policy can inject JavaScript that executes in the browser of any administrator viewing that page. The issue affects RabbitMQ Server versions prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5.

Critical Impact
Attackers with federation configuration privileges can execute arbitrary JavaScript in administrator browsers, enabling session hijacking, management API abuse, and lateral movement within the RabbitMQ cluster.

Affected Products

Broadcom RabbitMQ Server versions prior to 3.13.14
Broadcom RabbitMQ Server 4.0.x versions prior to 4.0.19
Broadcom RabbitMQ Server 4.1.x versions prior to 4.1.10 and 4.2.x versions prior to 4.2.5

Discovery Timeline

2026-07-10 - CVE-2026-57213 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-57213

Vulnerability Analysis

The vulnerability resides in the Federation Management plugin's EJS template at deps/rabbitmq_federation_management/priv/www/js/tmpl/federation.ejs. The template renders the consumer_tag attribute of federation links directly into HTML using unescaped output. Because the consumer_tag value is attacker-controlled at federation configuration time, any HTML or script content persists in the management UI.

When an administrator loads the Federation Status page, the malicious consumer_tag value is inlined into the DOM and interpreted by the browser. The attacker's script executes with the privileges of the viewing user, including access to the RabbitMQ management API session.

Root Cause

The root cause is missing output encoding. Other fields in the same template use the helper fmt_string/1, which HTML-escapes user-controlled values, but the consumer_tag field was rendered with the raw <%= %> EJS output tag. This inconsistency left one field unescaped despite the plugin's existing escaping helper.

Attack Vector

Exploitation requires an authenticated user with permission to configure a federation upstream or policy. The attacker sets the consumer-tag federation parameter to a payload containing HTML script content. When a privileged operator later opens the Federation Status page, the payload executes in their session context and can call the management HTTP API on their behalf.

text

     </td>
     <td><%= link.timestamp %></td>
     <td><%= link.id %></td>
-    <td><%= link.consumer_tag %></td>
+    <td><%= fmt_string(link.consumer_tag) %></td>
     <td>
         <form action="#/federation-restart-link" method="delete" class="confirm">
         <input type="hidden" name="id" value="<%= link.id %>"/>

Source: RabbitMQ commit 33dedfe. The patch wraps link.consumer_tag with fmt_string/1 to apply HTML escaping before rendering.

Detection Methods for CVE-2026-57213

Indicators of Compromise

Federation upstream or policy definitions containing consumer-tag values with HTML tags, angle brackets, or JavaScript keywords such as <script>, onerror=, or javascript:.
Unexpected outbound HTTP requests originating from an administrator browser session shortly after visiting /#/federation in the management UI.
Management API calls (for example, user creation or permission changes) issued from an admin session without a corresponding interactive action.

Detection Strategies

Inspect the RabbitMQ management API endpoint /api/parameters/federation-upstream and /api/policies for parameter values that contain HTML or script characters.
Enable audit logging on the management plugin and alert on federation configuration changes made by non-privileged operators.
Deploy a Content Security Policy (CSP) report-only header in front of the management UI and monitor violation reports for inline script execution.

Monitoring Recommendations

Track the installed RabbitMQ version across brokers and flag any node below 3.13.14, 4.0.19, 4.1.10, or 4.2.5.
Correlate management UI access logs with federation parameter modifications to identify potential victim administrators.
Alert on unusual management API activity such as bulk permission changes or new administrative user creation.

How to Mitigate CVE-2026-57213

Immediate Actions Required

Upgrade RabbitMQ Server to 3.13.14, 4.0.19, 4.1.10, or 4.2.5 or later, depending on your release branch.
Audit all existing federation upstreams and policies for suspicious consumer-tag values and remove any containing HTML or script content.
Restrict which users hold the policymaker and administrator tags so that federation configuration is limited to trusted operators.

Patch Information

The fix is available in RabbitMQ Server versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5. See the RabbitMQ Security Advisory GHSA-qxrp-7cmp-p77h, the corrective commits 33dedfe and c2d0d69, and the v4.2.5 release notes.

Workarounds

Disable the rabbitmq_federation_management plugin on production brokers if federation status visualization is not required.
Limit management UI access to a bastion network and require multi-factor authentication for accounts with the administrator tag.
Enforce a strict Content Security Policy on the reverse proxy in front of the RabbitMQ management UI to block inline script execution.

bash

# Disable the federation management UI plugin as a temporary workaround
rabbitmq-plugins disable rabbitmq_federation_management

# Verify installed version after upgrade
rabbitmqctl version