by Kastro CVE-2026-67237
rabbitmq rabbitmq-server — RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint
Description · from the CVE record
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorization header or access_token cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token content to execute JavaScript in the management UI origin. The endpoint is exposed before authentication only when management.oauth_enabled is true, and exploitation through the cookie path additionally requires the attacker to plant an access_token cookie on the management host. This issue is fixed in versions 4.2.8 and 4.3.2.
Affected
ProductAffectedFixed inSource
rabbitmq-server>= 4.2.0, < 4.2.8–CNA
rabbitmq-server>= 4.3.0, < 4.3.2–CNA
Scores by source
NVD9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
GitHub_M (CNA)7.5CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total