Stored XSS in RabbitMQ Management UI via mTLS Client Certificate Subject DN
CVSS 4.0
7.3high
EPSS
—
Published
()
Modified
AI analysis
RabbitMQ's management UI renders TLS client certificate Subject and Issuer DNs into connection pages without HTML escaping (connection.ejs:135 and streamConnection.ejs:102/106/110, using EJS 1.0 which does not auto-escape). An attacker who can obtain a client certificate signed by a CA the broker trusts — feasible where the TLS listener uses verify_peer, such as mTLS deployments with self-service corporate PKI or the rabbitmq_trust_store plugin — can embed JavaScript in the certificate's Subject DN. When an administrator opens that connection's detail page in the management UI, the script executes in the admin's session, enabling full management account takeover (creating users, exporting definitions, and so on); the UI's CSP includes 'unsafe-inline', so nothing blocks execution. Only deployments with ssl_options.verify = verify_peer are reachable — brokers without TLS peer verification are not affected, and the certificate must be CA-signed, not an arbitrary self-signed cert. No public proof of concept or in-the-wild exploitation is known.
What to do: Upgrade to RabbitMQ 3.13.15, 4.0.20, 4.1.11, or 4.2.6 (or later), which HTML-escape the rendered certificate fields. If immediate patching is not possible, restrict management UI access to trusted networks/VPNs, and tighten CA issuance policies so certificate Subject DNs cannot contain markup-like content. Audit management UI access and broker logs for connections whose peer certificate Subject DNs contain suspicious characters or script fragments.
Affected
Broadcom (RabbitMQ team) RabbitMQ
3.13.x prior to 3.13.15; 4.0.x prior to 4.0.20; 4.1.x prior to 4.1.11; 4.2.x prior to 4.2.6
Estimated exposure
largeTens of thousands of internet-exposed management UIs out of an estimated several hundred thousand RabbitMQ deployments, but only the subset using verify_peer… — RabbitMQ is one of the most widely deployed message brokers, with public scan engines typically showing tens of thousands of internet-reachable management UI (port 15672) instances, though the vulnerable subset is narrowed by the…
Description
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which does NOT HTML-escape. connection.ejs:135 renders (and peer_cert_issuer) directly into the page. The same pattern appears in streamConnection.ejs:102,106,110. The values come from rabbit_ssl:peer_cert_subject/1 which formats the DN as a string without HTML escaping. The verifier corrected the original researcher's claim: this is reachable only when the listener is configured with verify_peer (so the certificate must be signed by a CA in the broker's trust store, not arbitrary self-signed); however, in deployments using mTLS for client authentication, any user who can request a certificate from the organisational CA controls the Subject CN. An attacker who can obtain a TLS client certificate signed by a CA the broker trusts (with verify_peer enabled) can embed JavaScript in the certificate's Subject DN. When any administrator views that connection in the management UI, the script executes in the admin's browser session, allowing full account takeover (create users, export definitions, etc.). The management UI's CSP includes 'unsafe-inline', so inline script execution is not blocked. Preconditions include TLS listener configured with ssl_options.verify = verify_peer Attacker can obtain a CA-signed client certificate with attacker-chosen Subject (e.g. self-service corporate PKI, or rabbitmq_trust_store plugin in use) Administrator views the connection detail page. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Ubuntu’s USN-8933-1 fixes RabbitMQ issues that could enable CSRF, XSS, and denial of service.
Ubuntu security notice USN-8933-1 covers multiple RabbitMQ Server flaws. CVE-2026-66070 is incorrect CORS wildcard origin handling that could allow cross-site request forgery on several Ubuntu LTS releases. CVE-2026-66077 is improper handling of TLS peer-certificate distinguished names in the management UI that could allow cross-site scripting. The notice also describes mishandling of AMQP 1.0 arrays with zero-width element constructors that an attacker could use for denial of service; that issue’s CVE identifier is not included in the provided text. Exploitation is not reported.