Rabbitmq server: RabbitMQ is a messaging and streaming broker. (CVE-2026-67237)

CVE-2026-67237 describes a cross-site scripting vulnerability in RabbitMQ server's management UI OAuth bootstrap JavaScript. Specifically, in versions from 4.2.0 until 4.2.8 and 4.3.2, the set_token_auth/2 function inserts a bearer token from the Authorization header or access_token cookie into JavaScript without escaping, enabling attacker-controlled token content to execute arbitrary JavaScript in the management UI origin. The vulnerable endpoint is accessible before authentication only if management.oauth_enabled is true. Exploitation via the cookie path requires the attacker to have planted an access_token cookie on the management host. This vulnerability is resolved in RabbitMQ versions 4.2.8 and 4.3.2.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the RabbitMQ management UI origin, potentially leading to session hijacking or other client-side attacks. The vulnerability requires the management.oauth_enabled setting to be true and, for cookie-based exploitation, requires the attacker to have planted an access_token cookie on the management host. There are no known exploits in the wild at this time.

A fix is available and has been released in RabbitMQ versions 4.2.8 and 4.3.2. Users should upgrade to these versions or later to remediate this vulnerability. Additionally, ensure that the management.oauth_enabled setting is configured appropriately to reduce exposure. No other specific mitigations are indicated by the vendor advisory.