Rabbitmq server: RabbitMQ is a messaging and streaming broker. (CVE-2026-67421)

The vulnerability (CVE-2026-67421) affects RabbitMQ Management UI when OAuth is enabled. It arises from rendering an AMQP authorization-error reason containing an attacker-controlled queue name as HTML. Exploitation requires an attacker with queue configure permission and a management administrator who can see but not read the queue, combined with the administrator clicking 'Get Message(s)'. The queue name can include a base element that retargets the automatic relative refresh due to missing base-uri and connect-src directives in the Content Security Policy. An attacker endpoint that permits the management origin through CORS can then capture the victim administrator's Authorization header. This vulnerability is addressed in RabbitMQ versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.

Successful exploitation can lead to disclosure of the management administrator's Authorization header, potentially allowing unauthorized access or actions within the RabbitMQ Management interface. The vulnerability requires specific privileges and user interaction, limiting its exploitation scope. The CVSS 3.1 base score is 6.8 (medium severity), reflecting network attack vector, low attack complexity, high privileges required, user interaction, and high impact on confidentiality, integrity, and availability.

A fix is available and has been released in RabbitMQ versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5. Users should upgrade to these versions or later to remediate the vulnerability. No additional mitigation steps are indicated beyond applying the official patches.