CVE-2026-67236: RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused isauthorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding rather than encryption, an attacker with same-origin cross-site scripting, an HTTP-readable network position, or local access to the browser cookie store could recover the actual login credentials; older browsers that treated an absent SameSite attribute as None also sent the cookie cross-site. This issue is fixed in versions 4.2.8 and 4.3.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.2.8 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.3.2
Event History
Frequently Asked Questions
Who can realistically recover the credentials from the affected cookie?
An attacker needs a same-origin cross-site scripting condition, an HTTP-readable network position, or local access to the browser's cookie store. On older browsers that interpret an absent SameSite attribute as None, the cookie may also be sent with cross-site requests.
Are the credentials protected by encoding in the cookie?
No. The cookie contains base64-encoded username:password data, and base64 is reversible encoding rather than encryption, so someone who obtains the cookie can recover the actual credentials.
Which RabbitMQ releases need remediation?
The issue affects releases from 4.2.0 through 4.2.8 and version 4.3.2. The issue is fixed in 4.2.8 and 4.3.2.