XSS in Broadcom Rabbitmq Server
CVE-2026-67237
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorization header or access_token cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token content to execute JavaScript in the management UI origin. The endpoint is exposed before authentication only when management.oauth_enabled is true, and exploitation through the cookie path additionally requires the attacker to plant an access_token cookie on the management host. This issue is fixed in versions 4.2.8 and 4.3.2.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.3 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.005 (39.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 39th percentile — 39.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: -0.000
Affected products
- Broadcom Rabbitmq Server
- Rabbitmq Rabbitmq-Server — versions >= 4.2.0, < 4.2.8, >= 4.3.0, < 4.3.2
Weakness classification (CWE)
References
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-2rf7-f6r6-8rwh (Vendor Advisory)
- https://github.com/rabbitmq/rabbitmq-server/commit/5cd6d841d84450324a4613501ed917d98828af23 (Patch)
- https://github.com/rabbitmq/rabbitmq-server/commit/a8041d528c1a71af4cb75ade247ed082fe6b83fb (Patch)
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.8 (Patch, Release Notes)
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.2 (Patch, Release Notes)
Frequently asked questions
- What is CVE-2026-67237?
- CVE-2026-67237 is a critical-severity vulnerability in Broadcom Rabbitmq Server, classified under Cross-site Scripting. CVSS score: 9.3/10. Published 2026-09-25.
- How severe is CVE-2026-67237?
- Critical severity. CVSS v3 base score is 9.3 out of 10.