CVE-2026-57214: Broadcom RabbitMQ Server XSS Vulnerability

CVE-2026-57214 Overview

CVE-2026-57214 is a stored cross-site scripting (XSS) vulnerability in the RabbitMQ management UI. Versions prior to 4.2.5 render the x-internal-purpose queue or exchange argument into an HTML title attribute without proper escaping on the Queues and Exchanges pages. An authenticated user with permission to declare a queue or exchange can inject JavaScript that executes in another user's browser when the affected page is viewed. The flaw is tracked under [CWE-79] and resolved in RabbitMQ 4.2.5.

Critical Impact
An authenticated attacker with queue or exchange declaration rights can execute arbitrary JavaScript in the browser session of any administrator or user visiting the management UI, enabling session hijacking and management API abuse.

Affected Products

Broadcom RabbitMQ Server versions prior to 4.2.5
RabbitMQ management plugin (rabbitmq_management)
RabbitMQ federation plugin consumers that surface x-internal-purpose metadata

Discovery Timeline

2026-07-10 - CVE-2026-57214 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57214

Vulnerability Analysis

The vulnerability resides in the management UI JavaScript formatter used to render queue and exchange rows. When a queue or exchange is declared with the x-internal-purpose argument, the management UI embeds the argument value into the HTML title attribute of the rendered link. The value is concatenated into the DOM without HTML escaping. An attacker who supplies a crafted string containing markup or event-handler attributes breaks out of the title attribute context and injects arbitrary HTML or JavaScript. The payload persists as long as the queue or exchange exists, executing whenever an operator loads the Queues or Exchanges pages.

Root Cause

The root cause is missing output encoding in deps/rabbitmq_management/priv/www/js/formatters.js. The x-internal-purpose argument, originally intended for internal federation plugin metadata, was treated as trusted input and interpolated directly into HTML output.

Attack Vector

Exploitation requires network access to the AMQP or management endpoint and valid credentials with configure permissions on a virtual host. The attacker declares a queue or exchange whose x-internal-purpose argument contains a payload that terminates the title attribute and injects an event handler. Any user viewing the Queues or Exchanges page in the management UI triggers the payload with the privileges of their session.

javascript

// Security patch in deps/rabbitmq_management/priv/www/js/formatters.js
// Escape x-internal-purpose used by the federation plugin
     if (highlight == undefined) highlight = true;
     var title = null;
     if (args != undefined && args['x-internal-purpose'] != undefined) {
-        var purpose = args['x-internal-purpose'];
+        var purpose = fmt_escape_html(args['x-internal-purpose']);
         title = 'This is used internally by the ' + purpose + ' mechanism.';
     }
     return '<a href="' + url + '"' +
// Source: https://github.com/rabbitmq/rabbitmq-server/commit/b267a290dd89e42c6e0256f46fc273a8adb7f3ec

The patch wraps the argument value in fmt_escape_html() before concatenation, ensuring HTML metacharacters are neutralized.

Detection Methods for CVE-2026-57214

Indicators of Compromise

Queue or exchange declarations whose x-internal-purpose argument contains angle brackets, quotes, or JavaScript event handler substrings such as onerror= or onload=.
Management UI sessions issuing unexpected API calls to /api/users, /api/permissions, or /api/policies shortly after loading /#/queues or /#/exchanges.
Outbound HTTP requests from administrator browsers to unknown hosts referenced by injected script.

Detection Strategies

Query the RabbitMQ management API /api/queues and /api/exchanges and inspect the arguments object for x-internal-purpose values containing HTML metacharacters.
Alert on any x-internal-purpose value declared by a principal other than the federation plugin service account.
Correlate queue or exchange declaration events with subsequent management UI activity from privileged users.

Monitoring Recommendations

Log all AMQP queue.declare and exchange.declare operations that include non-empty x-internal-purpose arguments and forward them to a centralized analytics tier such as Singularity Data Lake for retention and query.
Monitor management UI HTTP access logs for unusual referrer patterns or session token reuse across IP addresses.
Track administrator browser telemetry on endpoints running Singularity Endpoint for anomalous script execution originating from RabbitMQ management URLs.

How to Mitigate CVE-2026-57214

Immediate Actions Required

Upgrade all RabbitMQ nodes to version 4.2.5 or later, which contains the escaping fix.
Audit existing queues and exchanges for x-internal-purpose values and delete or recreate any objects containing suspicious content.
Restrict configure permissions on virtual hosts to accounts that require them, removing broad declaration rights from application users.

Patch Information

The fix is included in RabbitMQ Release v4.2.5 and delivered through commits b0027b6c and b267a290. Additional context is available in pull requests #15606 and #15608 and the GHSA-6jfq-prw2-7rwp advisory.

Workarounds

Disable the rabbitmq_management plugin on production brokers and administer clusters exclusively through rabbitmqctl until the patch is deployed.
Restrict access to the management UI port (default TCP 15672) to a bastion network and require administrators to authenticate through a reverse proxy that enforces a strict Content Security Policy.
Revoke configure permissions from shared application accounts so that only trusted operators can declare queues or exchanges with custom arguments.

bash

# Configuration example: disable management plugin and tighten permissions
rabbitmq-plugins disable rabbitmq_management

# Restrict a user to read/write only, removing configure (declare) rights
rabbitmqctl set_permissions -p / app_user "" ".*" ".*"

# Verify installed version after upgrade
rabbitmqctl version