Junglewise Threat Intelligence

CVE-2026-57214: RabbitMQ stored XSS in management UI via x-internal-purpose argument

CVE-2026-57214 · Severity: info · CVSS 7.1 · Published 2026-07-10

Technologies: RabbitMQ. Vendors: RabbitMQ.

Executive brief

RabbitMQ is a widely used message broker that facilitates communication between different software applications. A security vulnerability in its management interface allows an attacker with basic permissions to inject malicious scripts into the dashboard. If an administrator views the affected pages, the attacker could potentially execute unauthorized actions or steal session information, compromising the management of the messaging infrastructure.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in the RabbitMQ Management UI prior to version 4.2.5. The vulnerability is located in the 'Queues' and 'Exchanges' pages, specifically within the `_link_to` function in `formatters.js`. The UI fails to properly escape the `x-internal-purpose` argument before rendering it into an HTML title attribute. An attacker with 'management' tag permissions and the ability to declare a queue or exchange can supply a malicious payload in this argument. When another user (such as an administrator) hovers over or views the affected component, the payload executes in their browser. This issue is fixed in RabbitMQ 4.2.5.

Affected products

  • RabbitMQ RabbitMQ >= 4.2.0, < 4.2.5

Timeline

  • 2026-03-02: patched: Fixes committed to main and v4.2.x branches
  • 2026-03-17: advisory: Release of version 4.2.5
  • 2026-07-10: disclosed: CVE published to NVD

References