CVE-2026-67237: RabbitMQ Management UI XSS Vulnerability

CVE-2026-67237 Overview

CVE-2026-67237 is a reflected Cross-Site Scripting (XSS) vulnerability in the RabbitMQ messaging and streaming broker. The flaw affects the set_token_auth/2 function in the management plugin's OAuth bootstrap handler. Attacker-controlled bearer token content from the Authorization header or access_token cookie is inserted into bootstrap JavaScript without escaping. This allows arbitrary JavaScript execution in the management UI origin.

The vulnerable endpoint is exposed pre-authentication when management.oauth_enabled is set to true. Exploitation through the cookie path additionally requires planting an access_token cookie on the management host. Affected versions span RabbitMQ 4.2.0 through 4.2.7 and 4.3.0 through 4.3.1. Fixed versions are 4.2.8 and 4.3.2.

Critical Impact
Successful exploitation executes attacker-supplied JavaScript in the RabbitMQ management UI origin, enabling session hijacking, credential theft, and arbitrary management actions against the broker.

Affected Products

RabbitMQ Server 4.2.0 through 4.2.7
RabbitMQ Server 4.3.0 through 4.3.1
RabbitMQ Management plugin (rabbitmq_management) with management.oauth_enabled = true

Discovery Timeline

2026-09-25 - CVE-2026-67237 published to the National Vulnerability Database (NVD)
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-67237

Vulnerability Analysis

The vulnerability resides in deps/rabbitmq_management/src/rabbit_mgmt_oauth_bootstrap.erl. When the management UI loads, the server renders an inline JavaScript bootstrap script that configures the client-side OAuth state. The set_token_auth/2 function reads a bearer token supplied by the client and concatenates it directly into the JavaScript source string.

Because the token value is not JSON-encoded or JavaScript-escaped, a token containing single quotes or script-breaking characters escapes the string literal. The attacker can then append arbitrary JavaScript that executes in the browser context of any user visiting the bootstrap endpoint. This is a classic reflected XSS pattern [CWE-79] against a server-rendered inline script.

Root Cause

The root cause is unsafe interpolation of untrusted input into a JavaScript context. The original code emitted ["set_token_auth('", Token, "');"], treating the token as a trusted string. Any single-quote character in Token closes the literal and permits injection of additional JavaScript statements. The fix routes the token through rabbit_json:encode/1, which produces a properly quoted and escaped JSON string literal safe for inline JavaScript.

Attack Vector

An unauthenticated attacker crafts a malicious URL or page that causes a victim's browser to request the OAuth bootstrap endpoint on a RabbitMQ management host with an attacker-controlled bearer token. Two reflection paths exist: an Authorization: Bearer <payload> header, or an access_token cookie planted on the management host. User interaction is required, consistent with reflected XSS. Successful execution runs JavaScript in the management UI origin and can perform any action the victim is authorized to perform.

erlang

                 {bearer, Token} ->
                     {
                         Req0,
-                        ["set_token_auth('", Token, "');"]
+                        ["set_token_auth(", rabbit_json:encode(Token), ");"]
                     };
                 _ ->
                     Cookies = cowboy_req:parse_cookies(Req0),

Source: RabbitMQ commit 5cd6d84 and commit a8041d5. The patch replaces raw string concatenation with rabbit_json:encode/1, which safely escapes special characters.

Detection Methods for CVE-2026-67237

Indicators of Compromise

HTTP requests to the RabbitMQ management OAuth bootstrap endpoint containing Authorization: Bearer header values with single quotes, angle brackets, or JavaScript keywords such as alert, fetch, or document.cookie.
Set-Cookie or inbound requests with an access_token cookie on the management host origin containing script fragments or unusual payload lengths.
Management UI responses whose inline set_token_auth('...') script contains unescaped quotes or executable statements.

Detection Strategies

Inspect reverse proxy and web application firewall logs for anomalous Authorization header content targeting / or OAuth bootstrap routes on management ports (default 15672).
Alert on RabbitMQ management hosts that have management.oauth_enabled = true but are not restricted to trusted networks.
Correlate browser referrer anomalies and short-lived sessions originating from the management UI to identify suspected phishing-driven exploitation.

Monitoring Recommendations

Enable access logging on the RabbitMQ management HTTP listener and ship logs to a central platform for retention and analytics.
Monitor for sudden changes to RabbitMQ users, permissions, policies, or federation configuration that could follow an administrative session hijack.
Track versions of rabbitmq-server across the fleet and alert on any instance still running 4.2.0 through 4.2.7 or 4.3.0 through 4.3.1.

How to Mitigate CVE-2026-67237

Immediate Actions Required

Upgrade RabbitMQ to version 4.2.8 or 4.3.2 on all brokers running the management plugin.
If immediate patching is not possible, set management.oauth_enabled = false to remove the pre-authentication exposure.
Restrict access to the management UI (default TCP 15672) to trusted administrative networks only.
Audit management users, permissions, and policies for unauthorized changes since the vulnerable version was deployed.

Patch Information

The fix is released in RabbitMQ v4.2.8 and RabbitMQ v4.3.2. The code change is documented in commit 5cd6d84 and commit a8041d5. Full advisory details are available in GHSA-2rf7-f6r6-8rwh.

Workarounds

Disable OAuth in the management plugin by setting management.oauth_enabled = false until the upgrade is applied.
Place the management UI behind a reverse proxy that strips or validates inbound Authorization headers and access_token cookies on bootstrap routes.
Enforce a strict Content Security Policy at the reverse proxy to block inline script execution for the management UI origin.

bash

# rabbitmq.conf - disable OAuth bootstrap pre-auth exposure
management.oauth_enabled = false

# Restrict management listener to loopback or trusted interface
management.tcp.ip   = 127.0.0.1
management.tcp.port = 15672