CVE-2026-67413
RabbitMQ is a messaging and streaming broker
- Risk score
- 51/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 25 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.23, 4.1.14, 4.2.9, and 4.3.3, the optional rabbitmq_jms_topic_exchange plugin's x-jms-topic exchange accepted a client-controlled rjms_erlang_selector binding expression whose LIKE evaluator expanded percent and underscore wildcards into overlapping PC…
- Affected
- Broadcom Rabbitmq Server before 4.0.23, 4.1.14, 4.2.9, 4.3.3
- Fix
- Upgrade Broadcom Rabbitmq Server to 4.0.23, 4.1.14, 4.2.9 or 4.3.3 (whichever matches your release line), or later.
- Exploitation
- Public proof of concept
Story map
At a glance
Broadcom Rabbitmq Server: Amber, patch this week. RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorization header or access_token cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token content to execute JavaScript in the management UI origin. T…
The flaws
- CVE-2026-67413: RabbitMQ is a messaging and streaming broker (CVSS 6.5 · EPSS 0%)
- CVE-2026-67237: RabbitMQ is a messaging and streaming broker (CVSS 9.3 · EPSS 0%)
- CVE-2026-66070: RabbitMQ is a messaging and streaming broker (CVSS 8.8 · EPSS 0%)
- CVE-2026-67231: RabbitMQ is a messaging and streaming broker (CVSS 9.1 · EPSS 0%)
The fix
Upgrade Broadcom Rabbitmq Server: 4.0.23 · 4.1.14 · 4.2.9 · 4.3.3 · 4.2.8 · 4.3.2 or later on your release line
Who is exposed: Broadcom Rabbitmq Server before 4.2.8, 4.3.2
Where it stands
- Public proof of concept
Connects to
- Same weakness: CWE-1333 (CWE-1333). 43 other warnings in 30 days
- Same product: Earlier Broadcom Rabbitmq Server warnings. 45 in the last 90 days
Why it is Yellow
- CVSS 6.5 medium
- Public exploit or proof of concept referenced
References
- https://github.com/rabbitmq/rabbitmq-server/commit/20203c50ea6ff459d462b2d4355326d3a870682c
- https://github.com/rabbitmq/rabbitmq-server/commit/60de2fbbcd812ab294985cef260cc2f1b1a02a5b
- https://github.com/rabbitmq/rabbitmq-server/commit/9e36b7f4c1e2eed77300288dca3e01bd9b23c432
- https://github.com/rabbitmq/rabbitmq-server/commit/f4d9da668b7304dfb9aeb2b4e9ff766a1275d021
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-chxf-3hfg-j8f7
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-chxf-3hfg-j8f7
Original description
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.23, 4.1.14, 4.2.9, and 4.3.3, the optional rabbitmq_jms_topic_exchange plugin's x-jms-topic exchange accepted a client-controlled rjms_erlang_selector binding expression whose LIKE evaluator expanded percent and underscore wildcards into overlapping PCRE fragments. It executed those fragments with raw re:run/3 without match or recursion limits, allowing an authenticated tenant that can bind and publish to consume broker scheduler CPU and deny service with pathological selectors. This issue is fixed in versions 4.0.23, 4.1.14, 4.2.9, and 4.3.3.
Last activity 25 Sep 2026. Patch Forecast updates every hour.