CVE-2026-67239: RabbitMQ Stream Management UI XSS Vulnerability

CVE-2026-67239 Overview

CVE-2026-67239 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in RabbitMQ's stream-management UI. The flaw affects the rabbitmq_stream_management plugin, which renders TLS peer-certificate Distinguished Name (DN) fields without proper HTML escaping. An attacker who presents a certificate signed by a CA trusted by the stream TLS listener can inject malicious script content into the DN. The payload executes when an operator views the stream-connection detail page in the management interface.

Critical Impact
Operators viewing a stream connection with an attacker-controlled peer certificate can have arbitrary JavaScript executed in their authenticated management session, enabling account takeover and broker configuration tampering.

Affected Products

RabbitMQ Server 3.13.0 through 3.13.17
RabbitMQ Server 4.0.0 through 4.0.22, 4.1.0 through 4.1.13, 4.2.0 through 4.2.8
RabbitMQ Server 4.3.0 through 4.3.2 (requires rabbitmq_stream + rabbitmq_stream_management with a TLS listener using verify_peer)

Discovery Timeline

2026-09-25 - CVE-2026-67239 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-67239

Vulnerability Analysis

The vulnerability resides in the stream-connection detail view of the rabbitmq_stream_management plugin. Lines 102, 106, and 110 of the connection template render peer_cert_subject and peer_cert_issuer using the raw <%= %> EJS output tag without invoking fmt_string(). The developers appear to have relied on RFC 4514 backslash-escaping of < and / within the DN to prevent injection. That escaping is HTML-inert; browsers interpret the escaped characters as literal syntax when parsing the surrounding markup.

Attackers can bypass the implicit filter by using self-closing tag constructs such as <img ... //>, where the trailing slash satisfies RFC 4514 escaping while still producing a valid HTML element. The injected script then executes in the operator's browser context under the management UI origin.

Root Cause

The root cause is missing output sanitization on fields derived from untrusted TLS client certificates. The template assumes RFC 4514 DN encoding is a sufficient defense against HTML injection. It is not. The absence of fmt_string() or an equivalent HTML-escape helper lets attacker-controlled characters reach the DOM verbatim.

Attack Vector

Exploitation requires a non-default configuration: a stream TLS listener with verify_peer enabled, plus access to a certificate signed by a CA the listener trusts. The attacker crafts the certificate's subject or issuer DN to contain an HTML payload, then connects to the stream endpoint. When an operator later opens the stream-connection detail page in the management UI, the payload executes against their authenticated session. See the GitHub Security Advisory GHSA-xm9p-57xv-vxwc for the full technical description.

Detection Methods for CVE-2026-67239

Indicators of Compromise

Stream TLS connections presenting peer certificates with DN components containing HTML tag characters, angle brackets, or self-closing patterns such as //>
Unexpected outbound requests originating from management-UI operator browsers shortly after viewing stream-connection pages
New or modified RabbitMQ users, permissions, or policies created from operator sessions without corresponding administrative activity

Detection Strategies

Audit TLS listener logs for incoming stream connections and extract the certificate subject/issuer DN for anomaly review
Inspect management-UI access logs for operator views of /api/stream/connections/* endpoints followed by anomalous API calls
Query broker state for any users or vhost permissions created outside change-management windows

Monitoring Recommendations

Alert on peer certificates with DN fields exceeding expected length or containing non-printable or markup characters
Monitor the trusted CA bundle used by stream listeners for unexpected additions or compromised intermediates
Enforce browser Content Security Policy (CSP) headers on the management UI and log CSP violation reports to a centralized SIEM for correlation

How to Mitigate CVE-2026-67239

Immediate Actions Required

Upgrade RabbitMQ to a patched version: 3.13.18, 4.0.23, 4.1.14, 4.2.9, or 4.3.3
If upgrade is not immediate, disable the rabbitmq_stream_management plugin on exposed brokers
Review the trusted CA list configured for stream TLS listeners and remove any CA not strictly required
Rotate management-UI operator credentials and sessions if operator browsers viewed stream-connection pages after untrusted connections

Patch Information

The fix is included in RabbitMQ releases v4.2.9 and v4.3.3, as well as 3.13.18, 4.0.23, and 4.1.14. The patch adds HTML escaping to peer_cert_subject and peer_cert_issuer rendering in the stream-management templates.

Workarounds

Set verify_peer to verify_none on stream TLS listeners only if client-certificate verification is not a security requirement in your deployment
Restrict the stream TLS listener to a private CA whose issuance is tightly controlled and reject externally signed certificates
Limit management-UI access to administrators who have been briefed on the risk and avoid viewing stream-connection detail pages until patched

bash

# Disable the vulnerable plugin until patching is complete
rabbitmq-plugins disable rabbitmq_stream_management