CVE-2026-67234— RabbitMQ: Non-RFC-conformant cookie name when clearing the auth-mechanism preference
Quick assessment
Affected
rabbitmq rabbitmq-server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
RabbitMQ 是一款消息和流式代理（broker）系统。在 4.2.0 到 4.2.8 版本以及 4.3.2 版本之前， 函数在处理清除对应 cookie 时，对 或 原子类型（atom）使用了 转换，导致生成的 cookie 名称包含非 ASCII 字符，违反了 RFC 6265 规范，并可能导致浏览器无法删除该偏好设置。 该漏洞不能直接用于代码执行或数据泄露；其安全影响仅限于：注销和重新登录循环中，过时的认证机制偏好设置会持续存在。该问题已在 4.2.8 和 4.3.2 版本中得到修复。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud StorageAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| rabbitmq | rabbitmq-server | >= 4.2.0, < 4.2.8 |
affected |
>= 4.3.0, < 4.3.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-67234
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
RabbitMQ: Non-RFC-conformant cookie name when clearing the auth-mechanism preference
Source: CVE Program / CVE List V5
Vulnerability Description
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, get_auth_mechanism/1 used term_to_binary/1 on the strict_auth_mechanism or preferred_auth_mechanism atom when clearing the corresponding cookie, producing a non-ASCII cookie name that violates RFC 6265 and can prevent the browser from deleting the preference. The issue is not directly exploitable for code execution or data exfiltration; its security relevance is limited to stale authentication-mechanism preferences persisting across logout and login cycles. This issue is fixed in versions 4.2.8 and 4.3.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| rabbitmq | rabbitmq-server | >= 4.2.0, < 4.2.8 | - |
|
II. Public POCs for CVE-2026-67234
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-67234
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-67234 (2)
Vendor Advisories for CVE-2026-67234 (1)
Vendor Pages for CVE-2026-67234 (2)
Same Patch Batch · rabbitmq · 2026-09-25 · 28 CVEs total
| CVE-2026-67236 | 8.2 HIGH | RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST / |
| CVE-2026-67409 | 8.2 HIGH | RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Au |
| CVE-2026-67410 | 8.2 HIGH | RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint |
| CVE-2026-67239 | 7.6 HIGH | RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UI |
| CVE-2026-67237 | 7.5 HIGH | RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint |
| CVE-2026-67408 | 7.1 HIGH | RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node |
| CVE-2026-67419 | 7.1 HIGH | RabbitMQ: Consecutive topic wildcards cause combinatorial routing work |
| CVE-2026-67226 | 6.9 MEDIUM | RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list |
| CVE-2026-61837 | 6.3 MEDIUM | RabbitMQ: AMQP 1.0 management `GET /bindings` exposes full binding topology to any authent |
| CVE-2026-67242 | 6.3 MEDIUM | RabbitMQ: OAuth2 is_integer(Exp) guard skips token-expiry checks for float exp |
| CVE-2026-67230 | 6.3 MEDIUM | RabbitMQ: Web-STOMP unbounded pre-auth accumulation |
| CVE-2026-67223 | 6.3 MEDIUM | RabbitMQ: LDAP DN injection via unescaped substitution |
| CVE-2026-67225 | 6.3 MEDIUM | RabbitMQ: Stream-protocol frame length never validated against frame_max |
| CVE-2026-67411 | 6.0 MEDIUM | RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass |
| CVE-2026-66073 | 6.0 MEDIUM | RabbitMQ: Atom table exhaustion via management API node field |
| CVE-2026-67412 | 6.0 MEDIUM | RabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message acces |
| CVE-2026-67413 | 6.0 MEDIUM | RabbitMQ: Authenticated RabbitMQ JMS Topic Selector Users Can Consume Broker CPU with an U |
| CVE-2026-66071 | 6.0 MEDIUM | RabbitMQ: Atom exhaustion: OAuth2 JWT tag: scope values |
| CVE-2026-67415 | 5.9 MEDIUM | RabbitMQ: Shovel Management Atom Exhaustion Allows Persistent Broker-Wide Denial of Servic |
| CVE-2026-67222 | 5.9 MEDIUM | RabbitMQ: list_to_atom on auth_mechanism URI tokens in amqp_client |
Showing top 20 of 28 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: rabbitmq-server
-
CVE-2026-67420
RabbitMQ OAuth credential refresh retains revoked runtime ta -
CVE-2026-67419
RabbitMQ: Consecutive topic wildcards cause combinatorial ro -
CVE-2026-67421
RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth -
CVE-2026-67408
RabbitMQ: Stream Management Super-Stream Binding Keys Alloca -
CVE-2026-67406
RabbitMQ: Federation and Shovel Gen-Servers Lack format_stat
Same vendor: rabbitmq
-
CVE-2026-67420
RabbitMQ OAuth credential refresh retains revoked runtime ta -
CVE-2026-67419
RabbitMQ: Consecutive topic wildcards cause combinatorial ro -
CVE-2026-67421
RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth -
CVE-2026-67408
RabbitMQ: Stream Management Super-Stream Binding Keys Alloca -
CVE-2026-67406
RabbitMQ: Federation and Shovel Gen-Servers Lack format_stat
Same weakness: CWE-20
-
CVE-2026-105117
OpenAM before 16.1.3 Email Content Injection via Users REST -
CVE-2026-63569
MTI/A0 DHAgreement does not validate the peer's ephemeral va -
CVE-2026-55094
Taskcluster: Unauthenticated remote code execution in `web-s -
CVE-2026-47547
NVIDIA驱动固件输入验证漏洞致代码执行 -
CVE-2026-47546
NVIDIA驱动固件输入验证漏洞致代码执行
V. Comments for CVE-2026-67234
No comments yet