CVE-2026-66070— RabbitMQ: CORS * reflects Origin with Allow-Credentials
Quick assessment
Affected
rabbitmq rabbitmq-server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
RabbitMQ 是一个消息和流媒体中间件。在版本 3.13.17、4.0.22、4.1.13 和 4.2.6 之前， 函数在配置了通配符 时，会返回原始反射的 头并允许携带凭证（credentials），导致响应中回显攻击者的 Origin 同时发送 头。受影响的代码位于 文件中。 当管理插件配置了通配符 CORS 源（即 ) 时，处理程序会将请求中的 头原样反射到 响应头中，并同时发送 。 在这种配置下，如果一个已登录的管理员访问了一个恶意网页，该网页可以利用该管理员浏览器中缓存的 HTTP Basic 认证凭
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-66070
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
RabbitMQ: CORS * reflects Origin with Allow-Credentials
Source: CVE Program / CVE List V5
Vulnerability Description
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match_origin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with Access-Control-Allow-Credentials. The affected code is rabbit_mgmt_cors.erl. When the management plugin is configured with a wildcard CORS origin (cors_allow_origins = ""), the handler reflects the request Origin back in Access-Control-Allow-Origin and also sends Access-Control-Allow-Credentials: true. A malicious web page that a signed-in administrator visits can then use that administrator's cached HTTP Basic credentials to issue authenticated, state-changing requests to the management API. Preconditions include The management plugin is configured with the wildcard cors_allow_origins = "*", which is an explicit operator misconfiguration A target administrator has a cached HTTP Basic-auth session in the browser. This issue is fixed in versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
过度许可的跨域白名单
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| rabbitmq | rabbitmq-server | >= 3.13.0, < 3.13.17 | - |
|
II. Public POCs for CVE-2026-66070
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-66070
请登录查看更多情报信息。
Vendor Pages for CVE-2026-66070 (1)
Other References for CVE-2026-66070 (1)
Same Patch Batch · rabbitmq · 2026-09-23 · 25 CVEs total
| CVE-2026-67404 | 9.2 CRITICAL | RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch |
| CVE-2026-67231 | 9.1 CRITICAL | RabbitMQ: Trust-store whitelist by Issuer+Serial only |
| CVE-2026-66079 | 8.2 HIGH | RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS |
| CVE-2026-67232 | 8.2 HIGH | RabbitMQ: Web-MQTT decompression bomb |
| CVE-2026-66077 | 7.3 HIGH | RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI |
| CVE-2026-67235 | 7.1 HIGH | RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size |
| CVE-2026-67238 | 7.1 HIGH | RabbitMQ: Atom-table exhaustion via reply-to queue name decoding |
| CVE-2026-67228 | 6.9 MEDIUM | RabbitMQ: Atom exhaustion: to_atom on runtime-parameter component |
| CVE-2026-67229 | 6.9 MEDIUM | RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata |
| CVE-2026-67219 | 6.0 MEDIUM | RabbitMQ: Consistent-hash exchange unbounded weight |
| CVE-2026-67220 | 6.0 MEDIUM | RabbitMQ: JMS topic exchange erl_scan atom exhaustion |
| CVE-2026-66067 | 6.0 MEDIUM | RabbitMQ: Stream protocol skips per vhost per user connection limits |
| CVE-2026-66074 | 6.0 MEDIUM | RabbitMQ: ReDoS via management API ?name= filter |
| CVE-2026-66072 | 6.0 MEDIUM | RabbitMQ: Atom table exhaustion via stream `chunk_selector` |
| CVE-2026-66080 | 5.9 MEDIUM | RabbitMQ: Super-stream partitions unbounded allocation |
| CVE-2026-67221 | 5.9 MEDIUM | RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords |
| CVE-2026-66068 | 5.6 MEDIUM | RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs |
| CVE-2026-67405 | 5.3 MEDIUM | RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation) |
| CVE-2026-66069 | 2.3 LOW | RabbitMQ: Monitoring-tag DELETE of auth-attempt metrics |
| CVE-2026-66076 | 2.3 LOW | RabbitMQ: Cross-vhost quorum-queue status and stream tracking disclosure |
Showing top 20 of 25 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: rabbitmq-server
-
CVE-2026-67420
RabbitMQ OAuth credential refresh retains revoked runtime ta -
CVE-2026-67419
RabbitMQ: Consecutive topic wildcards cause combinatorial ro -
CVE-2026-67421
RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth -
CVE-2026-67408
RabbitMQ: Stream Management Super-Stream Binding Keys Alloca -
CVE-2026-67406
RabbitMQ: Federation and Shovel Gen-Servers Lack format_stat
Same vendor: rabbitmq
-
CVE-2026-67420
RabbitMQ OAuth credential refresh retains revoked runtime ta -
CVE-2026-67419
RabbitMQ: Consecutive topic wildcards cause combinatorial ro -
CVE-2026-67421
RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth -
CVE-2026-67408
RabbitMQ: Stream Management Super-Stream Binding Keys Alloca -
CVE-2026-67406
RabbitMQ: Federation and Shovel Gen-Servers Lack format_stat
Same weakness: CWE-942
-
CVE-2026-90882
Reflected arbitrary origins with credentials, allowing cross -
CVE-2026-56595
HCL BigFix Service Management is affected by multiple securi -
CVE-2026-92359
ag-ui-protocol ag-ui CORSMiddleware utils.py create_strands_ -
CVE-2026-62895
Azure Arc SQL Server Extension Elevation of Privilege Vulner -
CVE-2026-12962
ASUS Armoury Crate 配置错误漏洞
V. Comments for CVE-2026-66070
No comments yet