CVE-2026-67421: RabbitMQ Management XSS Vulnerability

CVE-2026-67421 Overview

CVE-2026-67421 is an HTML injection vulnerability in the RabbitMQ Management UI. The flaw affects RabbitMQ versions from 3.13.0 up to (but not including) 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5. When the OAuth management UI is enabled, RabbitMQ Management renders an AMQP authorization-error reason containing an attacker-controlled queue name as HTML. An attacker with queue configure permission can craft a queue name containing a <base> element to retarget the management UI's automatic relative refresh. The Content Security Policy (CSP) omits base-uri and connect-src, allowing the attacker's endpoint to receive the victim administrator's Authorization header via CORS.

Critical Impact
Exploitation can disclose a management administrator's Authorization header to an attacker-controlled origin, enabling impersonation of that administrator against the RabbitMQ Management API.

Affected Products

RabbitMQ Server 3.13.0 through 3.13.18
RabbitMQ Server 4.0.0 through 4.0.23, 4.1.0 through 4.1.14, 4.2.0 through 4.2.9
RabbitMQ Server 4.3.0 through 4.3.4 with the OAuth management UI enabled

Discovery Timeline

2026-09-25 - CVE-2026-67421 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-67421

Vulnerability Analysis

The vulnerability is a Missing Authorization and output encoding failure classified as [CWE-862]. The RabbitMQ Management UI renders AMQP error reason strings as HTML without escaping, specifically in the OAuth login warnings template login_oauth.ejs. When an administrator with visibility but no read permission to a queue clicks Get Message(s), the broker returns an authorization-error reason that embeds the queue name verbatim. Because the response is rendered as HTML, an attacker-controlled queue name can inject arbitrary markup into the management UI DOM.

Root Cause

Two defects combine to create the exploit path. First, the warnings template outputs user-controlled values with <%=warnings[i]%> instead of HTML-escaping them. Second, the management UI's Content Security Policy omits the base-uri and connect-src directives. Without base-uri, an injected <base href="https://attacker/"> tag can retarget the UI's automatic relative refresh to an attacker origin. Without connect-src, the browser is free to issue the retargeted fetch, and the Authorization header is sent if the attacker endpoint permits the management origin through CORS.

Attack Vector

The attack requires three preconditions: an attacker with configure permission on a vhost, a management administrator who can see but not read the malicious queue, and that administrator invoking Get Message(s) against the queue. The attacker declares a queue whose name contains an injected <base> element pointing to an attacker-controlled host. When the administrator triggers the authorization error, the injected tag changes the base URI of the management page. The next automatic relative refresh then issues the request to the attacker, exposing the session's Authorization header.

text

// Patch excerpt: deps/rabbitmq_management/priv/www/js/tmpl/login_oauth.ejs
   <div id="login-status">
     <% if (Array.isArray(warnings)) { %>
         <% for (var i = 0; i < warnings.length; i++) { %>
-        <p class="warning"><%=warnings[i]%> </p>
+        <p class="warning"><%=fmt_escape_html(warnings[i])%> </p>
         <% } %>
     <% } %>
     <% if (notAuthorized) { %>

Source: RabbitMQ Server commit ff595ea. The patch wraps warning values with fmt_escape_html to prevent HTML injection.

Detection Methods for CVE-2026-67421

Indicators of Compromise

Queue names in the RabbitMQ broker containing HTML tags, especially <base, <script, or attribute delimiters such as " and >.
Outbound requests from administrator browsers to unexpected hosts shortly after accessing the RabbitMQ Management UI.
CORS preflight requests from the management origin to third-party domains referencing the Authorization header.

Detection Strategies

Audit queue definitions across all vhosts and flag any queue whose name does not conform to an expected naming convention (alphanumeric, dot, dash, underscore).
Review RabbitMQ Management access logs for Get Message(s) operations resulting in authorization errors, correlated with the originating administrator session.
Inspect browser network telemetry for requests from the management origin that include an Authorization: Bearer header sent to non-management hosts.

Monitoring Recommendations

Enable AMQP channel logging to capture queue.declare operations and the identity of the principal that created each queue.
Monitor for new queue declarations by non-administrative users and alert on queue names exceeding reasonable length or containing non-printable or markup characters.
Track RabbitMQ release versions across the fleet and alert on any node running a version earlier than 3.13.19, 4.0.24, 4.1.15, 4.2.10, or 4.3.5.

How to Mitigate CVE-2026-67421

Immediate Actions Required

Upgrade RabbitMQ to a patched release: 3.13.19, 4.0.24, 4.1.15, 4.2.10, or 4.3.5.
Enumerate existing queues and delete or rename any queue whose name contains HTML metacharacters.
Rotate OAuth tokens and management administrator credentials if administrators have interacted with suspicious queues through Get Message(s).

Patch Information

The fix is published in RabbitMQ Release v4.3.5 and backported to the 3.13.19, 4.0.24, 4.1.15, and 4.2.10 maintenance branches. The patch escapes warning strings in the OAuth management UI template using fmt_escape_html. Full technical details are available in GitHub Security Advisory GHSA-6256-27fm-4rgr.

Workarounds

Disable the OAuth management UI if it is not required, which removes the vulnerable rendering path.
Restrict configure permissions on vhosts so that only trusted principals can declare queues, reducing the pool of users who can plant malicious queue names.
Instruct management administrators to avoid clicking Get Message(s) on queues they do not own until the patch is applied.

bash

# Validate installed RabbitMQ version against patched releases
rabbitmqctl version

# Enumerate queues and highlight names containing HTML metacharacters
rabbitmqctl list_queues --no-table-headers name | grep -E '[<>"'\'']'

# Remove configure permission from a non-trusted user on a vhost
rabbitmqctl set_permissions -p / untrusted_user "" ".*" ".*"