Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

rabbitmq — Vulnerabilities & Security Advisories 93

Browse all 93 CVE security advisories affecting rabbitmq. AI-powered Chinese analysis, POCs, and references for each vulnerability.

RabbitMQ serves as a widely adopted message broker for enterprise messaging and queuing systems, enabling reliable communication between distributed applications. Historically, it has been susceptible to remote code execution vulnerabilities through deserialization flaws, cross-site scripting in management interfaces, and privilege escalation via authentication bypasses. The platform's default configurations often present attack surfaces, with past incidents including unauthorized access through exposed management consoles and credential stuffing attacks. While RabbitMQ maintains a relatively low CVE count compared to similar systems, its complex architecture requires careful hardening to prevent exploitation of common misconfigurations and access control weaknesses.

CVE ID Title CVSS Severity Published
CVE-2026-67420 RabbitMQ OAuth credential refresh retains revoked runtime tags — rabbitmq-server CWE-862 2.3 Low 2026-09-25
CVE-2026-67419 RabbitMQ: Consecutive topic wildcards cause combinatorial routing work — rabbitmq-server CWE-407 7.1 High 2026-09-25
CVE-2026-67421 RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling — rabbitmq-server CWE-862 4.5 Medium 2026-09-25
CVE-2026-67408 RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service — rabbitmq-server CWE-400 7.1 High 2026-09-25
CVE-2026-67406 RabbitMQ: Federation and Shovel Gen-Servers Lack format_status Callback — Plaintext Credentials Exposed in Crash Dumps and sys:get_status — rabbitmq-server CWE-200 4.6 Medium 2026-09-25
CVE-2026-67410 RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint — rabbitmq-server CWE-200 8.2 High 2026-09-25
CVE-2026-67227 RabbitMQ: Atom exhaustion: to_atom on global-parameter :name — rabbitmq-server CWE-400 5.9 Medium 2026-09-25
CVE-2026-67407 RabbitMQ: Incomplete fix for CVE-2026-44838: `escape_regex_char/1` does not escape `-`, leaving room for an MQTT topic permission bypass — rabbitmq-server CWE-862 5.1 Medium 2026-09-25
CVE-2026-67226 RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list — rabbitmq-server CWE-400 6.9 Medium 2026-09-25
CVE-2026-67411 RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass — rabbitmq-server CWE-863 6.0 Medium 2026-09-25
CVE-2026-67413 RabbitMQ: Authenticated RabbitMQ JMS Topic Selector Users Can Consume Broker CPU with an Unbounded LIKE Regular Expression — rabbitmq-server CWE-1333 6.0 Medium 2026-09-25
CVE-2026-61837 RabbitMQ: AMQP 1.0 management `GET /bindings` exposes full binding topology to any authenticated AMQP user without resource/management permission checks — rabbitmq-server CWE-285 6.3 Medium 2026-09-25
CVE-2026-67415 RabbitMQ: Shovel Management Atom Exhaustion Allows Persistent Broker-Wide Denial of Service — rabbitmq-server CWE-400 5.9 Medium 2026-09-25
CVE-2026-67412 RabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message access — rabbitmq-server CWE-862 6.0 Medium 2026-09-25
CVE-2026-67409 RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS — rabbitmq-server CWE-252 8.2 High 2026-09-25
CVE-2026-67242 RabbitMQ: OAuth2 is_integer(Exp) guard skips token-expiry checks for float exp — rabbitmq-server CWE-613 6.3 Medium 2026-09-25
CVE-2026-67223 RabbitMQ: LDAP DN injection via unescaped substitution — rabbitmq-server CWE-90 6.3 Medium 2026-09-25
CVE-2026-67239 RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UI — rabbitmq-server CWE-79 7.6 High 2026-09-25
CVE-2026-67241 RabbitMQ: AMQP 1.0 management exchange.declare skips alternate-exchange permission check — rabbitmq-server CWE-862 4.8 Medium 2026-09-25
CVE-2026-66071 RabbitMQ: Atom exhaustion: OAuth2 JWT tag: scope values — rabbitmq-server CWE-400 6.0 Medium 2026-09-25
CVE-2026-66078 RabbitMQ: protected tag bypass via bulk-delete — rabbitmq-server CWE-862 2.1 Low 2026-09-25
CVE-2026-66073 RabbitMQ: Atom table exhaustion via management API node field — rabbitmq-server CWE-400 6.0 Medium 2026-09-25
CVE-2026-67237 RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint — rabbitmq-server CWE-79 7.5 High 2026-09-25
CVE-2026-67234 RabbitMQ: Non-RFC-conformant cookie name when clearing the auth-mechanism preference — rabbitmq-server CWE-20 2.3 Low 2026-09-25
CVE-2026-67225 RabbitMQ: Stream-protocol frame length never validated against frame_max — rabbitmq-server CWE-770 6.3 Medium 2026-09-25
CVE-2026-67230 RabbitMQ: Web-STOMP unbounded pre-auth accumulation — rabbitmq-server CWE-770 6.3 Medium 2026-09-25
CVE-2026-67222 RabbitMQ: list_to_atom on auth_mechanism URI tokens in amqp_client — rabbitmq-server CWE-400 5.9 Medium 2026-09-25
CVE-2026-67236 RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login — rabbitmq-server CWE-312 8.2 High 2026-09-25
CVE-2026-67233 RabbitMQ: Monitoring-tag user can DELETE shovels — rabbitmq-server CWE-862 6.0 Medium 2026-09-24
CVE-2026-67221 RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords — rabbitmq-server CWE-312 5.9 Medium 2026-09-23

This page lists every published CVE security advisory associated with rabbitmq. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.