This vulnerability (CVE-2026-44839) affects rabbitmq-server, a messaging and streaming broker, due to improper neutralization of script-related HTML tags in web pages, categorized as CWE-80 (Basic XSS). It impacts versions >= 3.7.0 and < 4.0.13, and >= 4.1.0-alpha and < 4.1.2. The issue allows injection of malicious scripts in the web interface, potentially leading to cross-site scripting attacks. The vulnerability is resolved in versions 4.0.13 and 4.1.2. The CVSS 4.0 vector indicates network attack with high attack complexity, requiring user interaction and high privileges, but no integrity, availability, or confidentiality impact is indicated.

Successful exploitation could allow an attacker with high privileges and user interaction to execute script code in the context of the web interface, potentially leading to session hijacking or other client-side impacts. However, the vulnerability does not affect confidentiality, integrity, or availability of the server itself. No known exploits have been reported in the wild.

Upgrade rabbitmq-server to version 4.0.13 or later, or 4.1.2 or later, where this vulnerability is fixed. Since the vendor advisory does not provide additional remediation details, patching to the fixed versions is the recommended action. Patch status is confirmed by the version information in the description. No other mitigations are specified.