CVE-2026-66070
RabbitMQ is a messaging and streaming broker
- Risk score
- 64/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 23 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match_origin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with Access-Control-Allow-Credentials. The affect…
- Affected
- Broadcom Rabbitmq Server before 3.13.17, 4.0.22, 4.1.13, 4.2.6
- Fix
- Upgrade Broadcom Rabbitmq Server to 3.13.17, 4.0.22, 4.1.13 or 4.2.6 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Story map
At a glance
Broadcom Rabbitmq Server: Amber, patch this week. RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorization header or access_token cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token content to execute JavaScript in the management UI origin. T…
The flaws
- CVE-2026-66070: RabbitMQ is a messaging and streaming broker (CVSS 8.8 · EPSS 0%)
- CVE-2026-67237: RabbitMQ is a messaging and streaming broker (CVSS 9.3 · EPSS 0%)
- CVE-2026-67231: RabbitMQ is a messaging and streaming broker (CVSS 9.1 · EPSS 0%)
- CVE-2026-67230: RabbitMQ is a messaging and streaming broker (CVSS 7.5 · EPSS 1%)
The fix
Upgrade Broadcom Rabbitmq Server: 3.13.17 · 4.0.22 · 4.1.13 · 4.2.6 · 4.2.8 · 4.3.2 or later on your release line
Who is exposed: Broadcom Rabbitmq Server before 4.2.8, 4.3.2
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-942 (CWE-942). 5 other warnings in 30 days
- Same product: Earlier Broadcom Rabbitmq Server warnings. 45 in the last 90 days
Why it is Amber
- CVSS 8.8 high
- Remotely exploitable without logging in
References
Original description
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match_origin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with Access-Control-Allow-Credentials. The affected code is rabbit_mgmt_cors.erl. When the management plugin is configured with a wildcard CORS origin (cors_allow_origins = ""), the handler reflects the request Origin back in Access-Control-Allow-Origin and also sends Access-Control-Allow-Credentials: true. A malicious web page that a signed-in administrator visits can then use that administrator's cached HTTP Basic credentials to issue authenticated, state-changing requests to the management API. Preconditions include The management plugin is configured with the wildcard cors_allow_origins = "*", which is an explicit operator misconfiguration A target administrator has a cached HTTP Basic-auth session in the browser. This issue is fixed in versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6.
Last activity 23 Sep 2026. Patch Forecast updates every hour.