Rabbitmq server: RabbitMQ is a messaging and streaming broker. (CVE-2026-66077)

RabbitMQ versions prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6 have an XSS vulnerability in the management UI due to unescaped rendering of TLS client certificate Subject DN fields in EJS templates. Specifically, the connection.ejs and streamConnection.ejs templates render peer_cert_subject and peer_cert_issuer fields without HTML escaping. This is exploitable only when the TLS listener is configured with ssl_options.verify = verify_peer, meaning the broker verifies client certificates against a trusted CA. An attacker who can obtain a client certificate signed by a CA trusted by the broker (e.g., via organizational PKI or rabbitmq_trust_store plugin) can embed malicious JavaScript in the Subject DN. When an administrator views the affected connection page, the script executes in their browser session, enabling full account takeover actions such as creating users and exporting definitions. The management UI's Content Security Policy includes 'unsafe-inline', allowing inline script execution. The vulnerability is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

An attacker with a CA-signed client certificate and the ability to connect to a RabbitMQ server configured with verify_peer TLS verification can execute arbitrary JavaScript in the context of an administrator's browser session when the admin views the connection details page. This leads to full account takeover of the management UI, including creating users and exporting definitions. The vulnerability requires specific TLS configuration and attacker capabilities but can result in significant administrative control compromise.

A fix is available in RabbitMQ versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6. Administrators should upgrade to these or later versions to remediate this vulnerability. The vendor advisory confirms the patch availability. No alternative mitigations are specified. Ensure TLS listeners are configured securely and restrict issuance of client certificates to trusted entities.