CVE-2026-67239: RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UI

Q: Which deployments are exposed to this issue?

Exposure requires the stream management UI and stream plugin to be enabled, plus a TLS stream listener configured with peer verification. This is a non-default configuration, so deployments without that listener setup are not affected by the described attack path.

Q: What must an attacker do to trigger the XSS?

The attacker must obtain a certificate signed by a CA trusted by the affected listener and control its distinguished name. They must connect through the TLS stream listener, after which an operator must open the relevant stream-connection detail view in the management UI.

Q: What versions contain fixes?

The issue is fixed in RabbitMQ 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3.

Published Sep 25, 2026

Updated

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-certificate DN in stream-management UI (sibling of V-11). lines 102/106/110 render peercertsubject / peercertissuer with raw <%= %> and no fmtstring(). RFC4514 backslash-escaping of </> is HTML-inert and bypassable (<img ... //>). Requires non-default config: a stream TLS listener with verifypeer and an attacker-obtainable trusted cert with a malicious Same as the connection.ejs finding, against operators viewing the stream-connection detail rabbitmqstream + rabbitmqstreammanagement enabled with a TLS listener using verifypeer Attacker can obtain a certificate signed by a CA the listener trusts, with attacker-chosen DN An operator views the. This issue is fixed in versions 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3.

Affected Software

1 affected component

RabbitMQ RabbitMQ>=3.13.0<3.13.18, >=4.0.0<4.0.23, >=4.1.0<4.1.14, >=4.2.0<4.2.9, >=4.3.0<4.3.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade RabbitMQ to a version that resolves this vulnerability.
Fixed in 3.13.18
Upgrade
Upgrade RabbitMQ to a version that resolves this vulnerability.
Fixed in 4.0.23
Upgrade
Upgrade RabbitMQ to a version that resolves this vulnerability.
Fixed in 4.1.14
Upgrade
Upgrade RabbitMQ to a version that resolves this vulnerability.
Fixed in 4.2.9
Upgrade
Upgrade RabbitMQ to a version that resolves this vulnerability.
Fixed in 4.3.3

Event History

Sep 25, 2026

CVE Published

via MITRE·04:13 PM

Data Sourced

via MITRE·04:13 PM

DescriptionWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Exposure requires the stream management UI and stream plugin to be enabled, plus a TLS stream listener configured with peer verification. This is a non-default configuration, so deployments without that listener setup are not affected by the described attack path.

What must an attacker do to trigger the XSS?