CVE-2026-67237: RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, settokenauth/2 inserted a bearer token from the Authorization header or accesstoken cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token content to execute JavaScript in the management UI origin. The endpoint is exposed before authentication only when management.oauthenabled is true, and exploitation through the cookie path additionally requires the attacker to plant an accesstoken cookie on the management host. This issue is fixed in versions 4.2.8 and 4.3.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.2.8 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.3.2
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated access to the vulnerable endpoint?
The endpoint is exposed before authentication only when management.oauth_enabled is true. Deployments without that setting enabled are not described as exposing the endpoint pre-authentication.
What attacker-controlled input can trigger the script injection?
A bearer token supplied in the Authorization header can be inserted into the OAuth bootstrap JavaScript without escaping. The access_token cookie is another input path, but exploiting that path requires the attacker to first plant an access_token cookie on the management host.
Which versions should be remediated?
The affected range is 4.2.0 through 4.2.8 and version 4.3.2. Fixed versions are identified as 4.2.8 and 4.3.2.