CVE-2026-66077: RabbitMQ stored XSS in management UI connection details

CVE-2026-66077 · Severity: info · Published 2026-09-23

RabbitMQ's management UI fails to properly sanitize certificate Subject fields when displaying TLS connection details, allowing stored cross-site scripting (XSS). An attacker who obtains a CA-signed TLS client certificate can embed malicious JavaScript in the certificate's Subject field. When an administrator views the connection details, the script executes with the administrator's privileges, enabling account takeover and full system compromise.

Technologies: VMware RabbitMQ. Vendors: VMware.

Quick answers

Is CVE-2026-66077 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-66077 being exploited in the wild.
How severe is CVE-2026-66077?
Informational severity, published 23 September 2026.
Which products and versions are affected?
VMware RabbitMQ 3.13.0 to 3.13.14, 4.0.0 to 4.0.19, 4.1.0 to 4.1.10, 4.2.0 to 4.2.5.
Is there a fix for CVE-2026-66077?
A patch was published on 2026-09-23: Fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-66077 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-66077?
Check whether you run VMware RabbitMQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored XSS in RabbitMQ's management UI (connection.ejs and streamConnection.ejs) where certificate Subject and Issuer fields are rendered into HTML without escaping via EJS 1.0's <%= %> operator. The attack requires: (1) a TLS listener configured with ssl_options.verify = verify_peer, (2) the attacker obtaining a CA-signed certificate with a malicious Subject DN (e.g., through corporate PKI or the rabbitmq_trust_store plugin), and (3) an administrator viewing the connection details page. CSP headers include 'unsafe-inline', permitting inline script execution. The fix is available in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

Affected products

  • VMware RabbitMQ 3.13.0 to 3.13.14, 4.0.0 to 4.0.19, 4.1.0 to 4.1.10, 4.2.0 to 4.2.5

Timeline

  • 2026-09-23: disclosed
  • 2026-09-23: patched: Fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.