CVE-2026-9844: Roche navify Digital Pathology Auth Bypass

CVE-2026-9844 Overview

CVE-2026-9844 is a default credentials vulnerability affecting the RabbitMQ Management interface modules shipped with Roche Diagnostics navify Digital Pathology. The product retains factory-default usernames and passwords on the message broker management console, allowing remote, unauthenticated attackers to authenticate as privileged users. The flaw is tracked under CWE-1392: Use of Default Credentials and impacts navify Digital Pathology versions from 2.0.0 up to but not including 2.4.1.

Critical Impact
An attacker with network access to the RabbitMQ Management interface can log in with documented default credentials, manipulate queues and exchanges, exfiltrate diagnostic messaging data, and disrupt pathology workflows.

Affected Products

Roche Diagnostics navify Digital Pathology 2.0.0 through 2.4.0
RabbitMQ Management interface modules bundled with the affected versions
Deployments where the RabbitMQ Management interface is reachable over the network

Discovery Timeline

2026-06-02 - CVE-2026-9844 published to the National Vulnerability Database
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-9844

Vulnerability Analysis

The vulnerability resides in the RabbitMQ Management interface modules bundled with navify Digital Pathology. The deployment ships with default usernames and passwords that are not rotated or forced to change on first use. The RabbitMQ Management plugin exposes an HTTP-based administrative interface, typically on TCP port 15672, including a REST API for queue, exchange, user, and policy management.

An attacker reaching this interface over the network can authenticate using the documented defaults. Once authenticated, the attacker inherits administrative control over the broker. This includes reading messages in flight, redirecting traffic between producers and consumers, creating new users, and altering broker configuration. In a digital pathology environment, the broker carries imaging job metadata and workflow events, so compromise translates directly to integrity and availability loss for diagnostic processes.

Root Cause

The root cause is an insecure default configuration. The application installer enables the RabbitMQ Management plugin with built-in credentials and does not enforce credential rotation, account lockout, or interface binding to a trusted management network. This pattern is captured by CWE-1392.

Attack Vector

Exploitation is network-based and requires no prior authentication or user interaction. An attacker who can reach the management endpoint sends an HTTP GET or POST request to the RabbitMQ Management REST API with the default Authorization: Basic header. Successful authentication returns broker state and permits administrative actions through endpoints such as /api/users, /api/queues, and /api/exchanges. No exploit code is required beyond standard HTTP tooling, and no public proof-of-concept is currently listed.

The vulnerability is described in prose only; refer to the Roche Product Security Advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-9844

Indicators of Compromise

Successful HTTP 200 responses on /api/whoami or /api/overview from external sources to the RabbitMQ Management port
Authentication events on the RabbitMQ broker using known default usernames such as guest or vendor-shipped service accounts
Unexpected creation of administrative users via PUT /api/users/<name> or new permission grants via PUT /api/permissions
Unscheduled changes to queues, exchanges, bindings, or shovel and federation policies

Detection Strategies

Audit RabbitMQ logs at /var/log/rabbitmq/ for accepting AMQP connection and management plugin login events tied to default account names
Inspect network telemetry for inbound connections to TCP 15672 and 15671 from outside the management subnet
Run authenticated configuration scans against navify Digital Pathology hosts to confirm versions earlier than 2.4.1
Compare current RabbitMQ user lists against an approved baseline using rabbitmqctl list_users

Monitoring Recommendations

Forward RabbitMQ access and audit logs to a centralized analytics platform with alerting on default-account authentication
Continuously monitor for new HTTP listeners on management ports across the pathology environment
Alert on REST API calls that modify users, permissions, or virtual hosts outside change windows

How to Mitigate CVE-2026-9844

Immediate Actions Required

Upgrade navify Digital Pathology to version 2.4.1 or later as directed by the Roche Product Security Advisory
Replace all default RabbitMQ usernames and passwords, including the built-in guest account, with unique high-entropy credentials
Restrict the RabbitMQ Management interface to a dedicated management network using firewall rules or host-based ACLs
Inventory existing RabbitMQ users and remove any unrecognized administrative accounts

Patch Information

Roche Diagnostics addresses the issue in navify Digital Pathology2.4.1. The fixed release removes the use of default credentials in the RabbitMQ Management interface modules. Operators should review the Roche Product Security Advisory for upgrade instructions and verification steps.

Workarounds

Disable the RabbitMQ Management plugin where it is not required using rabbitmq-plugins disable rabbitmq_management
Bind the management listener to 127.0.0.1 only and tunnel administrative access through SSH or a VPN
Enforce TLS on management endpoints and require client certificates where supported
Apply strict role-based access control through rabbitmqctl set_user_tags and rabbitmqctl set_permissions to limit blast radius

bash

# Configuration example: remove the default guest account and restrict management bind address
rabbitmqctl delete_user guest
rabbitmqctl add_user navify_admin '<strong-random-password>'
rabbitmqctl set_user_tags navify_admin administrator
rabbitmqctl set_permissions -p / navify_admin '.*' '.*' '.*'

# /etc/rabbitmq/rabbitmq.conf
management.tcp.ip = 127.0.0.1
management.tcp.port = 15672
loopback_users.guest = true