CVE-2026-44839 is a vulnerability in RabbitMQ where unsanitized virtual host names allow for Cross-Site Scripting (XSS) in the management UI pages listing virtual hosts. Successful exploitation requires an attacker with high privileges to force a virtual host restart and user interaction. The vulnerability has a low impact on confidentiality and integrity. Red Hat has issued an update for Red Hat Hardened Images RPMs, including rabbitmq-server4.3-4.3.6-1.hum1, to fix this issue. The advisory emphasizes restricting management UI access to trusted administrators as a mitigation.

An attacker with high privileges could exploit this XSS vulnerability to execute malicious scripts in the RabbitMQ management UI, potentially leading to limited confidentiality and integrity impacts. The attack surface is limited due to the requirement for high privileges and user interaction. There is no impact on availability. The vulnerability could allow disclosure of sensitive information or unauthorized actions within the management UI context.

A fix is available in the updated rabbitmq-server4.3-4.3.6-1.hum1 packages provided by Red Hat. Users should apply this update to remediate the vulnerability. Additionally, restrict access to the RabbitMQ management UI to trusted administrators only and ensure it is not exposed to untrusted networks to reduce the risk of exploitation.