RabbitMQ Management in versions 3.13.0 through 3.13.18, 4.0.0 through 4.0.23, 4.1.0 through 4.1.14, 4.2.0 through 4.2.9, and 4.3.0 through 4.3.4 improperly renders an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI is enabled. Exploitation requires an attacker with queue configure permission and a management administrator who can see but not read the queue, and the administrator clicking 'Get Message(s)'. The vulnerability arises because the Content Security Policy omits base-uri and connect-src directives, allowing an attacker endpoint that permits the management origin through CORS to receive the victim's Authorization header. This missing authorization check is classified as CWE-862. The issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.

An attacker with queue configure permission can craft a queue name that, when reflected in an authorization error in the management UI, can cause a victim management administrator to inadvertently leak their Authorization header to an attacker-controlled endpoint via CORS. This could lead to unauthorized access or session hijacking within the RabbitMQ management interface. The vulnerability requires user interaction and specific permissions, limiting its impact to medium severity.

This vulnerability is fixed in RabbitMQ versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5. Users should upgrade to these or later versions to remediate the issue. No alternative mitigations or temporary fixes are indicated in the advisory.