CVE-2026-67234: RabbitMQ: Non-RFC-conformant cookie name when clearing the auth-mechanism preference
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, getauthmechanism/1 used termtobinary/1 on the strictauthmechanism or preferredauthmechanism atom when clearing the corresponding cookie, producing a non-ASCII cookie name that violates RFC 6265 and can prevent the browser from deleting the preference. The issue is not directly exploitable for code execution or data exfiltration; its security relevance is limited to stale authentication-mechanism preferences persisting across logout and login cycles. This issue is fixed in versions 4.2.8 and 4.3.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.2.8 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.3.2
Event History
Frequently Asked Questions
Which deployments are affected?
RabbitMQ versions from 4.2.0 through 4.2.8 and version 4.3.2 are affected. The issue concerns browser-based handling of authentication-mechanism preference cookies.
What is required for this issue to have an effect?
A browser must hold a strict_auth_mechanism or preferred_auth_mechanism preference that RabbitMQ attempts to clear. The malformed non-ASCII cookie name can then prevent the browser from deleting that preference across logout and later login cycles.
What is the practical security impact?
The documented impact is limited to stale authentication-mechanism preferences persisting in the browser. It is not directly exploitable for code execution or data exfiltration.
What versions contain the fix?
The issue is fixed in RabbitMQ 4.2.8 and 4.3.2.