CVE-2026-67231
RabbitMQ is a messaging and streaming broker
- Risk score
- 62/100
- CVSS
- 9.1 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 23 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verify_fun that overrides {bad_cert, unknown_ca} / {bad_cert, selfsigned_peer} when the presented cert "matches" a whitelisted one. The match key is extract_issuer_id/1 → public_…
- Affected
- Broadcom Rabbitmq Server before 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.0
- Fix
- Upgrade Broadcom Rabbitmq Server to 3.13.15, 4.0.20, 4.1.11, 4.2.6 or 4.3.0 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Story map
At a glance
Broadcom Rabbitmq Server: Amber, patch this week. RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorization header or access_token cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token content to execute JavaScript in the management UI origin. T…
The flaws
- CVE-2026-67231: RabbitMQ is a messaging and streaming broker (CVSS 9.1 · EPSS 0%)
- CVE-2026-67237: RabbitMQ is a messaging and streaming broker (CVSS 9.3 · EPSS 0%)
- CVE-2026-66070: RabbitMQ is a messaging and streaming broker (CVSS 8.8 · EPSS 0%)
- CVE-2026-67230: RabbitMQ is a messaging and streaming broker (CVSS 7.5 · EPSS 1%)
The fix
Upgrade Broadcom Rabbitmq Server: 3.13.15 · 4.0.20 · 4.1.11 · 4.2.6 · 4.3.0 · 4.2.8 or later on your release line
Who is exposed: Broadcom Rabbitmq Server before 4.2.8, 4.3.2
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-295 (CWE-295). 82 other warnings in 30 days
- Same product: Earlier Broadcom Rabbitmq Server warnings. 45 in the last 90 days
Why it is Amber
- CVSS 9.1 critical
- Remotely exploitable without logging in
References
Original description
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verify_fun that overrides {bad_cert, unknown_ca} / {bad_cert, selfsigned_peer} when the presented cert "matches" a whitelisted one. The match key is extract_issuer_id/1 → public_key:pkix_issuer_id/2 → {IssuerName, SerialNumber} , both fields are taken verbatim from the presented certificate body and contain no public-key, SKI, fingerprint or signature material. is_whitelisted/1 is a pure ets:member lookup; the stored full DER is used only for list/0 display and is never compared against the presented cert. cacerts is [], so the whitelisted cert is never used as a trust anchor for path validation either. TLS client-authentication bypass: an attacker who knows the issuer DN + serial of any whitelisted certificate can connect with a forged self-signed cert. Preconditions include rabbitmq_trust_store plugin enabled and used as the TLS verify_fun Attacker knows or can guess the {Issuer, Serial} of at least one whitelisted cert (non-secret; exposed via CLI/logs/any cert copy). This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
Last activity 23 Sep 2026. Patch Forecast updates every hour.