Rabbitmq server: RabbitMQ is a messaging and streaming broker. (CVE-2026-67239)
Description
CVE-2026-67239 is a stored cross-site scripting (XSS) vulnerability in RabbitMQ server's stream-management UI. It affects versions from 3.13.0 up to but not including 3.13.18, and several 4.x versions up to specific fixed releases. The vulnerability arises from improper rendering of TLS peer-certificate distinguished names (DN) without proper escaping, allowing an attacker with a trusted certificate to inject malicious HTML/JavaScript. This requires a non-default configuration with a TLS listener using peer verification and an attacker-obtainable trusted certificate. The issue is fixed in versions 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3.
CVSS v4.0
Affected software
pkg:deb/ubuntu/rabbitmq-server?arch=source&distro=esm-infra-legacy/xenialpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=esm-infra/bionicpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=esm-infra/focalpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=jammypkg:deb/ubuntu/rabbitmq-server?arch=source&distro=noblepkg:deb/ubuntu/rabbitmq-server?arch=source&distro=stonkingpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
RabbitMQ server versions 3.13.0 through 3.13.17 and certain 4.x versions prior to 4.0.23, 4.1.14, 4.2.9, and 4.3.3 contain a stored XSS vulnerability in the stream-management UI. The vulnerability occurs because the TLS peer-certificate DN fields are rendered using raw template tags without proper HTML escaping, allowing malicious input to be executed in the context of the UI. Exploitation requires a non-default configuration where a TLS listener with peer verification is enabled, and the attacker can present a certificate signed by a trusted CA with a malicious DN. Operators viewing the stream-connection details can be affected. The vulnerability is addressed by patches in the specified fixed versions.
Potential Impact
An attacker who can obtain a certificate signed by a CA trusted by the RabbitMQ TLS listener and who can connect to the service can exploit this vulnerability to execute arbitrary scripts in the context of the RabbitMQ stream-management UI. This could lead to UI manipulation or other client-side attacks against operators viewing the affected UI pages. The impact is limited to operators with UI access and requires specific TLS configurations and attacker capabilities.
Mitigation Recommendations
A fix is available and has been released in RabbitMQ versions 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3. Users should upgrade to these or later versions to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-67239
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 4.0
- State
- PUBLISHED
Patch Information
Threat ID: 6ad3f5a92cdf04f6566627e8
Added to database: 10/17/2026, 22:24:41 UTC
Last enriched: 10/17/2026, 23:58:12 UTC
Last updated: 10/17/2026, 23:58:12 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.