CVE-2026-66070: CWE-942: Permissive Cross-domain Policy with Untrusted Domains in rabbitmq rabbitmq-server
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match_origin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with Access-Control-Allow-Credentials. The affected code is rabbit_mgmt_cors.erl. When the management plugin is configured with a wildcard CORS origin (cors_allow_origins = ""), the handler reflects the request Origin back in Access-Control-Allow-Origin and also sends Access-Control-Allow-Credentials: true. A malicious web page that a signed-in administrator visits can then use that administrator's cached HTTP Basic credentials to issue authenticated, state-changing requests to the management API. Preconditions include The management plugin is configured with the wildcard cors_allow_origins = "*", which is an explicit operator misconfiguration A target administrator has a cached HTTP Basic-auth session in the browser. This issue is fixed in versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6.
AI Analysis
Technical Summary
RabbitMQ versions before 3.13.17, 4.0.22, 4.1.13, and 4.2.6 have a vulnerability in the rabbit_mgmt_cors.erl component where the match_origin/1 function returns the bare reflected Origin and allows credentials when the wildcard cors_allow_origins = "*" is configured. This causes the Access-Control-Allow-Origin header to echo the attacker's origin along with Access-Control-Allow-Credentials: true. If an administrator has a cached HTTP Basic-auth session and visits a malicious web page, that page can issue authenticated requests to the management API, potentially changing state. This is due to an explicit operator misconfiguration of the management plugin's CORS settings.
Potential Impact
An attacker can exploit this vulnerability to perform cross-origin authenticated requests to the RabbitMQ management API using the credentials of a signed-in administrator who has a cached HTTP Basic-auth session. This can lead to unauthorized state changes in the management API, potentially compromising the RabbitMQ server's integrity and management operations.
Mitigation Recommendations
This issue is fixed in rabbitmq-server versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6. Operators should upgrade to these or later versions to remediate the vulnerability. Additionally, avoid configuring the management plugin with the wildcard cors_allow_origins = "*" to prevent this misconfiguration. Patch status is confirmed fixed in the stated versions.
CVE-2026-66070: CWE-942: Permissive Cross-domain Policy with Untrusted Domains in rabbitmq rabbitmq-server
Description
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match_origin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with Access-Control-Allow-Credentials. The affected code is rabbit_mgmt_cors.erl. When the management plugin is configured with a wildcard CORS origin (cors_allow_origins = ""), the handler reflects the request Origin back in Access-Control-Allow-Origin and also sends Access-Control-Allow-Credentials: true. A malicious web page that a signed-in administrator visits can then use that administrator's cached HTTP Basic credentials to issue authenticated, state-changing requests to the management API. Preconditions include The management plugin is configured with the wildcard cors_allow_origins = "*", which is an explicit operator misconfiguration A target administrator has a cached HTTP Basic-auth session in the browser. This issue is fixed in versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6.
CVSS v4.0
Score 7.6high
Affected software
rabbitmq
rabbitmq-server
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
RabbitMQ versions before 3.13.17, 4.0.22, 4.1.13, and 4.2.6 have a vulnerability in the rabbit_mgmt_cors.erl component where the match_origin/1 function returns the bare reflected Origin and allows credentials when the wildcard cors_allow_origins = "*" is configured. This causes the Access-Control-Allow-Origin header to echo the attacker's origin along with Access-Control-Allow-Credentials: true. If an administrator has a cached HTTP Basic-auth session and visits a malicious web page, that page can issue authenticated requests to the management API, potentially changing state. This is due to an explicit operator misconfiguration of the management plugin's CORS settings.
Potential Impact
An attacker can exploit this vulnerability to perform cross-origin authenticated requests to the RabbitMQ management API using the credentials of a signed-in administrator who has a cached HTTP Basic-auth session. This can lead to unauthorized state changes in the management API, potentially compromising the RabbitMQ server's integrity and management operations.
Mitigation Recommendations
This issue is fixed in rabbitmq-server versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6. Operators should upgrade to these or later versions to remediate the vulnerability. Additionally, avoid configuring the management plugin with the wildcard cors_allow_origins = "*" to prevent this misconfiguration. Patch status is confirmed fixed in the stated versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-23T23:25:28.897Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab43089f7a7c54106431424
Added to database: 09/23/2026, 20:03:21 UTC
Last enriched: 09/23/2026, 20:18:58 UTC
Last updated: 09/24/2026, 02:40:56 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.