Rabbitmq server: RabbitMQ is a messaging and streaming broker. (CVE-2026-66070)

The vulnerability (CVE-2026-66070) affects RabbitMQ's management plugin CORS implementation (rabbit_mgmt_cors.erl). Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, when the management plugin is configured with a wildcard CORS origin (cors_allow_origins = "*"), the match_origin/1 function returns the bare reflected Origin and allows credentials. This causes the server to echo the attacker's origin in Access-Control-Allow-Origin and send Access-Control-Allow-Credentials: true. Consequently, a malicious web page visited by an administrator with cached HTTP Basic credentials can perform authenticated, state-changing requests to the management API. The vulnerability requires explicit misconfiguration of the management plugin and a cached admin session in the browser. The issue is resolved in the stated fixed versions.

An attacker can exploit this vulnerability to perform cross-origin authenticated requests to the RabbitMQ management API using the credentials of a signed-in administrator who has a cached HTTP Basic-auth session. This could allow unauthorized state-changing actions on the management API, potentially compromising the RabbitMQ server's configuration or operation. The impact is limited by the requirement of a misconfigured wildcard CORS origin and a cached administrator session.

A fix is available in RabbitMQ versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6. Users should upgrade to these or later versions to remediate the vulnerability. Additionally, avoid configuring the management plugin with a wildcard CORS origin (cors_allow_origins = "*") to prevent this issue. Review and adjust CORS settings to restrict allowed origins appropriately.