Junglewise Threat Intelligence

CVE-2026-57213: RabbitMQ stored XSS in rabbitmq_federation_management plugin

CVE-2026-57213 · Severity: info · CVSS 5.7 · Published 2026-07-10

Vendors: RabbitMQ.

Executive brief

RabbitMQ is a widely used messaging broker that facilitates communication between different software applications. A security vulnerability in its federation management plugin allows an attacker with administrative privileges to inject malicious scripts into the management interface. If another user views the Federation Status page, these scripts could execute in their browser, potentially leading to unauthorized actions or data theft within the management session.

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in the RabbitMQ rabbitmq_federation_management plugin. The root cause is the failure to perform HTML escaping on the 'consumer_tag' field when rendering the Federation Status page. An attacker with high privileges (sufficient to configure federation upstreams or policies) can inject a malicious payload into this field. When an administrative user subsequently visits the Federation Status page, the payload executes in their browser context. This issue is resolved in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5 by utilizing the 'fmt_string/1' function to ensure proper output encoding.

Affected products

  • rabbitmq rabbitmq-server >= 3.13.0, < 3.13.14
  • rabbitmq rabbitmq-server >= 4.0.0, < 4.0.19
  • rabbitmq rabbitmq-server >= 4.1.0, < 4.1.10
  • rabbitmq rabbitmq-server >= 4.2.0, < 4.2.5

Timeline

  • 2026-03-11: patched: Fixes merged into main and v4.2.x branches
  • 2026-03-17: advisory: Release of version 4.2.5 containing the fix
  • 2026-07-10: disclosed: CVE-2026-57213 published

References