# CVE-2026-66077: RabbitMQ stored XSS in management UI connection details

Source: https://junglewise.ai/threats/cve-2026-66077-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-3  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-66077 · Severity: info · Published 2026-09-23

RabbitMQ's management UI fails to properly sanitize certificate Subject fields when displaying TLS connection details, allowing stored cross-site scripting (XSS). An attacker who obtains a CA-signed TLS client certificate can embed malicious JavaScript in the certificate's Subject field. When an administrator views the connection details, the script executes with the administrator's privileges, enabling account takeover and full system compromise.

Technologies: [VMware RabbitMQ](https://junglewise.ai/threats/technologies/vmware-rabbitmq). Vendors: [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-66077 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66077 being exploited in the wild.

**How severe is CVE-2026-66077?** Informational severity, published 23 September 2026.

**Which products and versions are affected?** VMware RabbitMQ 3.13.0 to 3.13.14, 4.0.0 to 4.0.19, 4.1.0 to 4.1.10, 4.2.0 to 4.2.5.

**Is there a fix for CVE-2026-66077?** A patch was published on 2026-09-23: Fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-66077 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-66077?** Check whether you run VMware RabbitMQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored XSS in RabbitMQ's management UI (connection.ejs and streamConnection.ejs) where certificate Subject and Issuer fields are rendered into HTML without escaping via EJS 1.0's <%= %> operator. The attack requires: (1) a TLS listener configured with ssl_options.verify = verify_peer, (2) the attacker obtaining a CA-signed certificate with a malicious Subject DN (e.g., through corporate PKI or the rabbitmq_trust_store plugin), and (3) an administrator viewing the connection details page. CSP headers include 'unsafe-inline', permitting inline script execution. The fix is available in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

## Affected products

- VMware RabbitMQ 3.13.0 to 3.13.14, 4.0.0 to 4.0.19, 4.1.0 to 4.1.10, 4.2.0 to 4.2.5

## Timeline

- 2026-09-23: disclosed
- 2026-09-23: patched: Fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6

## Related threats

- [RabbitMQ MQTT 5 parser invalid property denial of service](https://junglewise.ai/threats/cve-2026-67418-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-3)
- [RabbitMQ AMQP 1.0 parser descriptor validation bypass](https://junglewise.ai/threats/cve-2026-67416-rabbitmq-is-a-messaging-and-streaming-broker-from-4-0-0-until-4-0)
- [RabbitMQ AMQP 1.0 parser memory exhaustion](https://junglewise.ai/threats/cve-2026-67414-rabbitmq-is-a-messaging-and-streaming-broker-from-4-0-0-until-4-0)
- [RabbitMQ Management XSS via queue name in OAuth UI](https://junglewise.ai/threats/cve-2026-67421-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-3)
- [RabbitMQ JMS topic exchange denial of service via regex wildcard expansion](https://junglewise.ai/threats/cve-2026-67413-rabbitmq-is-a-messaging-and-streaming-broker-from-4-0-0-until-4-0)