Executive brief
RabbitMQ is a widely used messaging broker that facilitates communication between different software applications. A security vulnerability in its management interface allows an attacker with high-level administrative privileges to inject malicious scripts via specially named virtual hosts. If another administrator views the affected management page, the script could execute, potentially leading to the theft of sensitive session information or unauthorized actions within the management console.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the RabbitMQ Management UI due to improper neutralization of virtual host (vhost) names. The vulnerability is located in the 'vhost.ejs' and 'vhosts.ejs' templates, where forms used to restart a crashed vhost include a hidden input field containing the vhost name without using the 'fmt_string' sanitizer. An attacker with high privileges (ability to create vhosts) can craft a malicious vhost name containing a script payload. For the attack to succeed, the vhost must be in a 'crashed' state and a victim administrator must visit the specific vhost management page. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session.
Affected products
- RabbitMQ RabbitMQ 3.7.0 to < 4.0.13, 4.1.0 to < 4.1.2
Timeline
- 2026-05-06: advisory: GitHub Security Advisory published
- 2026-05-27: disclosed: CVE published to NVD