CVE-2026-67237
Description
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorization header or access_token cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token content to execute JavaScript in the management UI origin. The endpoint is exposed before authentication only when management.oauth_enabled is true, and exploitation through the cookie path additionally requires the attacker to plant an access_token cookie on the management host. This issue is fixed in versions 4.2.8 and 4.3.2.
How to fix
- broadcom rabbitmq_server4.2.8, 4.3.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| broadcom rabbitmq_server | 4.2.0 ≤ v < 4.2.8, 4.3.0 ≤ v < 4.3.2 | 4.2.8, 4.3.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.