CVE-2026-67421

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-67421
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67421.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-67421
Aliases
Downstream
Published
2026-09-25T16:39:02Z
Modified
2026-10-21T02:59:02Z
Severity
  • 4.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N CVSS Calculator
Summary
RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling
Details

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI was enabled. Exploitation requires an attacker with queue configure permission, a management administrator who can see but cannot read that queue, and the administrator clicking Get Message(s). A queue name containing a base element can then retarget the automatic relative refresh because the Content Security Policy omits base-uri and connect-src, and an attacker endpoint that permits the management origin through CORS can receive the victim's Authorization header. This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67421.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "3.13.0"
                        },
                        {
                            "fixed":  "3.13.19"
                        },
                        {
                            "introduced":  "4.0.0"
                        },
                        {
                            "fixed":  "4.0.24"
                        },
                        {
                            "introduced":  "4.1.0"
                        },
                        {
                            "fixed":  "4.1.15"
                        },
                        {
                            "introduced":  "4.2.0"
                        },
                        {
                            "fixed":  "4.2.10"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StringRangeExpression"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/rabbitmq/rabbitmq-server

Affected ranges

Type
GIT
Repo
https://github.com/rabbitmq/rabbitmq-server
Events
Introduced
1929eeadf9b2bac12c5434fb56884ef27370580e
Fixed
0dde27bfdd1984ff7e157226fd97656854a7f359
Fixed
ff595eaaa6d4f580f72fa04801ffd35f48c46027
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.3.0"
                },
                {
                    "fixed":  "4.3.5"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "ff595eaaa6d4f580f72fa04801ffd35f48c46027"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v4.3.5",
            "range":  [
                {
                    "fixed":  "0dde27bfdd1984ff7e157226fd97656854a7f359"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

v4.*
v4.3.0
v4.3.1
v4.3.2
v4.3.3
v4.3.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67421.json"