Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-67406

RabbitMQ is a messaging and streaming broker

Risk score
48/100
CVSS
6.5 v3.1
Exploit chance (30 days)
0.3%
Published
25 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, Shovel does not format state logged by the crash reporter and can leave unencrypted credentials in a crash dump file. the shovel worker genserver processes does not implement the formatstatus/2 callback. When these process…
Affected
Broadcom Rabbitmq Server before 4.3.3, 4.2.9, 4.1.14, 4.0.23
Fix
Upgrade Broadcom Rabbitmq Server to 4.3.3, 4.2.9, 4.1.14 or 4.0.23 (whichever matches your release line), or later.
Exploitation
Public proof of concept

Story map

Story map: Broadcom Rabbitmq ServerTHE FLAWSTHE FIXCVE-2026-67406RabbitMQ is a messaging andstreaming brokerCVSS 6.5 · EPSS 0%CVE-2026-67237RabbitMQ is a messaging andstreaming brokerCVSS 9.3 · EPSS 0%CVE-2026-66070RabbitMQ is a messaging andstreaming brokerCVSS 8.8 · EPSS 0%CVE-2026-67231RabbitMQ is a messaging andstreaming brokerCVSS 9.1 · EPSS 0%Upgrade Broadcom Rabbitmq…4.3.3 · 4.2.9 · 4.1.14 · 4.0.23 ·4.2.8 · 4.3.2or later on your release lineWho is exposedBroadcom Rabbitmq Serverbefore 4.2.8, 4.3.2AMBER · PATCH THIS WEEKBroadcomRabbitmq ServerRabbitMQ is a messaging andstreaming broker. From 4.2.0until 4.2.8 and 4.3.2,set_token_auth/2 inserted abearer token from theAuthorization header oraccess_token cookie into OAuth…Where it standsPublic proof of conceptCONNECTS TOSame weaknessInformation disclosure (CWE-200)197 other warnings in 30 days →Same productEarlier Broadcom Rabbitmq Server warnings45 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Broadcom Rabbitmq Server: Amber, patch this week. RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorization header or access_token cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token content to execute JavaScript in the management UI origin. T…

The flaws

  • CVE-2026-67406: RabbitMQ is a messaging and streaming broker (CVSS 6.5 · EPSS 0%)
  • CVE-2026-67237: RabbitMQ is a messaging and streaming broker (CVSS 9.3 · EPSS 0%)
  • CVE-2026-66070: RabbitMQ is a messaging and streaming broker (CVSS 8.8 · EPSS 0%)
  • CVE-2026-67231: RabbitMQ is a messaging and streaming broker (CVSS 9.1 · EPSS 0%)

The fix

Upgrade Broadcom Rabbitmq Server: 4.3.3 · 4.2.9 · 4.1.14 · 4.0.23 · 4.2.8 · 4.3.2 or later on your release line

Who is exposed: Broadcom Rabbitmq Server before 4.2.8, 4.3.2

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 6.5 medium
  • Public exploit or proof of concept referenced

References

Original description

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, Shovel does not format state logged by the crash reporter and can leave unencrypted credentials in a crash dump file. the shovel worker genserver processes does not implement the formatstatus/2 callback. When these processes crash (e.g., due to network partitions, connection failures), the OTP SASL error handler writes the full process state , including plaintext AMQP passwords and URIs , to the error log. This is particularly severe for the shovel worker, which stores deobfuscated plaintext URIs (including amqp://user:password@host format) in its genserver state for the entire process Automatic Credential Exposure: Shovel worker crashes (common during network partitions) automatically write plaintext upstream/downstream passwords to error logs No Special Configuration Needed: Unlike DEBUG logging, SASL error reports are always active Broad. This issue is fixed in versions 4.3.3, 4.2.9, 4.1.14, and 4.0.23.

Last activity 25 Sep 2026. Patch Forecast updates every hour.