Rabbitmq server: RabbitMQ is a messaging and streaming broker. (CVE-2026-67236)

RabbitMQ server versions 4.2.0 through 4.2.8 and 4.3.2 have a vulnerability where the authentication cookie set after a successful POST /login request contains base64-encoded username and password credentials without security flags such as HttpOnly, Secure, SameSite, or expiration. Because base64 encoding is reversible, attackers with same-origin cross-site scripting, network access to HTTP traffic, or local browser cookie access can retrieve plaintext credentials. Older browsers that treat absent SameSite attributes as None may send this cookie cross-site, increasing exposure. This vulnerability is resolved in RabbitMQ versions 4.2.8 and 4.3.2.

An attacker able to exploit this vulnerability can recover actual login credentials from the authentication cookie, potentially leading to unauthorized access. The vulnerability affects confidentiality of credentials but does not impact integrity or availability directly. Exploitation requires conditions such as same-origin XSS, network access to HTTP traffic, or local access to browser cookies.

A patch is available and should be applied. The issue is fixed in RabbitMQ versions 4.2.8 and 4.3.2. Users should upgrade to these or later versions to remediate the vulnerability. No additional vendor advisory mitigation instructions indicate other actions are required.