Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

rabbitmq-server — Vulnerabilities & Security Advisories 74

All 74 CVE vulnerabilities found in rabbitmq-server, with AI-generated Chinese analysis, references, and POCs.

This page documents security vulnerabilities affecting the rabbitmq-server product, specifically focusing on Common Weakness Enumerations relevant to this message broker software. It aggregates known security issues, configuration flaws, and implementation errors discovered in the open-source messaging platform developed by VMware and maintained by the RabbitMQ community. The content encompasses vulnerability records spanning from early releases in 2007 through the latest stable versions released in 2024, ensuring comprehensive historical coverage and up-to-date risk assessment capabilities. Visitors to this resource can track vendor advisories issued by the RabbitMQ project team and official security channels to understand the context and severity of each disclosed issue. Users can also analyze specific weakness classes such as cross-site scripting, injection flaws, or insecure default configurations to comprehend how these generic weaknesses manifest within the RabbitMQ architecture. Furthermore, the page enables users to look up a product's vulnerability history, allowing for the identification of trends, recurring security patterns, and the effectiveness of past mitigation efforts. This structured overview supports security professionals, developers, and system administrators in evaluating the risk posture of their RabbitMQ deployments and prioritizing remediation activities based on verified data rather than speculative reports. By centralizing this information, the page serves as a critical reference for maintaining the integrity and reliability of messaging infrastructure that relies on RabbitMQ for inter-process communication and event-driven architectures.

Vendor: rabbitmq

CVE ID Title CVSS Severity Published
CVE-2026-67420 RabbitMQ OAuth credential refresh retains revoked runtime tags CWE-862 2.3 Low 2026-09-25
CVE-2026-67419 RabbitMQ: Consecutive topic wildcards cause combinatorial routing work CWE-407 7.1 High 2026-09-25
CVE-2026-67421 RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling CWE-862 4.5 Medium 2026-09-25
CVE-2026-67408 RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service CWE-400 7.1 High 2026-09-25
CVE-2026-67406 RabbitMQ: Federation and Shovel Gen-Servers Lack format_status Callback — Plaintext Credentials Exposed in Crash Dumps and sys:get_status CWE-200 4.6 Medium 2026-09-25
CVE-2026-67410 RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint CWE-200 8.2 High 2026-09-25
CVE-2026-67227 RabbitMQ: Atom exhaustion: to_atom on global-parameter :name CWE-400 5.9 Medium 2026-09-25
CVE-2026-67407 RabbitMQ: Incomplete fix for CVE-2026-44838: `escape_regex_char/1` does not escape `-`, leaving room for an MQTT topic permission bypass CWE-862 5.1 Medium 2026-09-25
CVE-2026-67226 RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list CWE-400 6.9 Medium 2026-09-25
CVE-2026-67411 RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass CWE-863 6.0 Medium 2026-09-25
CVE-2026-67413 RabbitMQ: Authenticated RabbitMQ JMS Topic Selector Users Can Consume Broker CPU with an Unbounded LIKE Regular Expression CWE-1333 6.0 Medium 2026-09-25
CVE-2026-61837 RabbitMQ: AMQP 1.0 management `GET /bindings` exposes full binding topology to any authenticated AMQP user without resource/management permission checks CWE-285 6.3 Medium 2026-09-25
CVE-2026-67415 RabbitMQ: Shovel Management Atom Exhaustion Allows Persistent Broker-Wide Denial of Service CWE-400 5.9 Medium 2026-09-25
CVE-2026-67412 RabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message access CWE-862 6.0 Medium 2026-09-25
CVE-2026-67409 RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS CWE-252 8.2 High 2026-09-25
CVE-2026-67242 RabbitMQ: OAuth2 is_integer(Exp) guard skips token-expiry checks for float exp CWE-613 6.3 Medium 2026-09-25
CVE-2026-67223 RabbitMQ: LDAP DN injection via unescaped substitution CWE-90 6.3 Medium 2026-09-25
CVE-2026-67239 RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UI CWE-79 7.6 High 2026-09-25
CVE-2026-67241 RabbitMQ: AMQP 1.0 management exchange.declare skips alternate-exchange permission check CWE-862 4.8 Medium 2026-09-25
CVE-2026-66071 RabbitMQ: Atom exhaustion: OAuth2 JWT tag: scope values CWE-400 6.0 Medium 2026-09-25
CVE-2026-66078 RabbitMQ: protected tag bypass via bulk-delete CWE-862 2.1 Low 2026-09-25
CVE-2026-66073 RabbitMQ: Atom table exhaustion via management API node field CWE-400 6.0 Medium 2026-09-25
CVE-2026-67237 RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint CWE-79 7.5 High 2026-09-25
CVE-2026-67234 RabbitMQ: Non-RFC-conformant cookie name when clearing the auth-mechanism preference CWE-20 2.3 Low 2026-09-25
CVE-2026-67225 RabbitMQ: Stream-protocol frame length never validated against frame_max CWE-770 6.3 Medium 2026-09-25
CVE-2026-67230 RabbitMQ: Web-STOMP unbounded pre-auth accumulation CWE-770 6.3 Medium 2026-09-25
CVE-2026-67222 RabbitMQ: list_to_atom on auth_mechanism URI tokens in amqp_client CWE-400 5.9 Medium 2026-09-25
CVE-2026-67236 RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login CWE-312 8.2 High 2026-09-25
CVE-2026-67233 RabbitMQ: Monitoring-tag user can DELETE shovels CWE-862 6.0 Medium 2026-09-24
CVE-2026-67221 RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords CWE-312 5.9 Medium 2026-09-23

All 74 known CVE vulnerabilities affecting rabbitmq-server with full Chinese analysis, references, and POCs where available.