CVE-2026-66077 Overview
CVE-2026-66077 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in the RabbitMQ management UI. The flaw stems from the UI's use of EJS 1.0, where the <%= ... %> tag does not HTML-escape output. The connection.ejs and streamConnection.ejs templates render TLS peer certificate fields (peer_cert_subject, peer_cert_issuer) directly into the DOM. An attacker holding a CA-signed client certificate with an attacker-controlled Subject Distinguished Name (DN) can inject JavaScript that executes in an administrator's browser session. The issue affects RabbitMQ versions prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Critical Impact
Successful exploitation grants full administrative account takeover of the RabbitMQ broker, including user creation and definition export.
Affected Products
- RabbitMQ Server versions prior to 3.13.15
- RabbitMQ Server 4.0.x prior to 4.0.20 and 4.1.x prior to 4.1.11
- RabbitMQ Server 4.2.x prior to 4.2.6
Discovery Timeline
- 2026-09-23 - CVE-2026-66077 published to NVD
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-66077
Vulnerability Analysis
The RabbitMQ management UI ships with EJS 1.0 templates that render TLS connection metadata. In connection.ejs:135, the template emits <%= connection.ssl_details.peer_cert_subject %> and peer_cert_issuer using the unescaped output tag. The same unsafe pattern repeats in streamConnection.ejs on lines 102, 106, and 110. These values originate from rabbit_ssl:peer_cert_subject/1, which serializes the certificate DN as a raw string with no sanitization.
Exploitation requires that a TLS listener is configured with ssl_options.verify = verify_peer, meaning the presented certificate must chain to a CA in the broker's trust store. In mutual TLS (mTLS) deployments backed by a corporate PKI or the rabbitmq_trust_store plugin, any user able to request a client certificate can control the Subject Common Name (CN). The management UI's Content Security Policy (CSP) includes 'unsafe-inline', so inline <script> payloads are not blocked.
Root Cause
The root cause is missing output encoding in server-rendered templates combined with a permissive CSP. EJS 1.0's <%= %> syntax passes strings verbatim, and the certificate DN formatter returns untrusted attacker-controlled data.
Attack Vector
An attacker obtains a CA-signed client certificate with a Subject DN containing JavaScript, then opens a TLS connection to the broker. When an administrator navigates to the connection detail page in the management UI, the injected script executes with the administrator's session privileges. The script can create new users, export broker definitions, or modify permissions.
See the GitHub Security Advisory GHSA-rjcf-35r5-xw38 for the reference implementation details.
Detection Methods for CVE-2026-66077
Indicators of Compromise
- TLS client certificates presented to the broker containing HTML or JavaScript syntax (<script>, onerror=, javascript:) in the Subject or Issuer DN fields.
- Unexpected user or permission changes in RabbitMQ shortly after an administrator accessed the connections page.
- Outbound HTTP requests from an administrator's browser to unknown hosts while viewing the management UI.
Detection Strategies
- Inspect the RabbitMQ connection logs and audit the DN of every accepted mTLS client certificate for non-printable or markup characters.
- Enumerate certificates issued by trusted CAs and flag any Subject CN containing angle brackets, quotes, or scripting keywords.
- Correlate administrator UI sessions with subsequent management API calls that create users or export definitions.
Monitoring Recommendations
- Enable RabbitMQ audit logging and forward events to a centralized SIEM for review of user.created and permission.set operations.
- Monitor the CA issuance pipeline for client certificates with anomalous Subject fields.
- Alert on browser telemetry that shows script execution originating from the management UI origin.
How to Mitigate CVE-2026-66077
Immediate Actions Required
- Upgrade RabbitMQ to version 3.13.15, 4.0.20, 4.1.11, or 4.2.6 depending on the deployed branch.
- Audit the broker's trust store and remove any CA that permits unvetted self-service certificate issuance.
- Rotate administrator credentials and API tokens if unauthorized configuration changes are suspected.
Patch Information
The upstream fix is included in RabbitMQ 3.13.15, 4.0.20, 4.1.11, and 4.2.6. Release notes are available at the RabbitMQ Server Release v4.2.6 page. Apply the patch relevant to your minor version rather than jumping releases.
Workarounds
- Disable the management UI on brokers where administrative browsing is not required, or restrict its access to a segmented network.
- Restrict issuance of CA-signed client certificates so that Subject DN fields are constrained to safe character sets by policy.
- Where feasible, terminate mTLS at an upstream proxy that validates and rewrites certificate metadata before it reaches RabbitMQ.
# Configuration example: disable the management listener until patched
rabbitmq-plugins disable rabbitmq_management
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
