USN-8933-1: RabbitMQ Server vulnerabilities
Ubuntu’s USN-8933-1 fixes RabbitMQ issues that could enable CSRF, XSS, and denial of service.
Ubuntu security notice USN-8933-1 covers multiple RabbitMQ Server flaws. CVE-2026-66070 is incorrect CORS wildcard origin handling that could allow cross-site request forgery on several Ubuntu LTS releases. CVE-2026-66077 is improper handling of TLS peer-certificate distinguished names in the management UI that could allow cross-site scripting. The notice also describes mishandling of AMQP 1.0 arrays with zero-width element constructors that an attacker could use for denial of service; that issue’s CVE identifier is not included in the provided text. Exploitation is not reported.
- CVE-2026-66070 is a CORS wildcard issue that could enable CSRF.
- CVE-2026-66077 is XSS via TLS peer-certificate DNs in the management UI.
- A separate AMQP 1.0 parsing flaw could cause denial of service.
- No in-the-wild exploitation is reported in the notice.
Vulnerabilities mentionedAll →
- CVE-2026-660707.6—CORS credential reflection in RabbitMQ management plugin enables admin session hijackingpublished · RabbitMQ (management plugin, rabbit_mgmt_cors.erl)+1 related
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
CVE-2026-66070+1 related CVE | CORS credential reflection in RabbitMQ management plugin enables admin session hijacking RabbitMQ's management plugin CORS handler (rabbit_mgmt_cors.erl, match_origin/1) reflects any request Origin and sends Access-Control-Allow-Credentials: true even when the operator has configured the wildcard cors_allow_origins = "*". Because the Access-Control-Allow-Origin header echoes back the attacker's own origin, a malicious web page visited by an administrator can make authenticated, state-changing requests to the management API using that administrator's cached HTTP Basic-auth credentials. An attacker thereby gains the administrator's full management privileges over the broker (user, vhost, queue, and permission changes via the API) from an arbitrary website. Only deployments that explicitly set the wildcard CORS origin are exploitable, and the flaw is fixed in 3.13.17, 4.0.22, 4.1.13, and 4.2.6. No public proof-of-concept or in-the-wild exploitation is known, and the issue is not in CISA's KEV catalog. |
It was discovered that RabbitMQ Server incorrectly handled CORS wildcard origin configuration. An attacker could possibly use this issue to cause a cross-site request forgery attack. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-66070) It was discovered that RabbitMQ Server incorrectly handled TLS peer-certificate DNs in the management UI. An attacker could possibly use this issue to cause a cross-site scripting attack. (CVE-2026-66077) It was discovered that RabbitMQ Server incorrectly handled AMQP 1.0 arrays with zero-width element constructors. An attacker could possibly use this issue to cause a denial of…
This source does not provide full text. Read it at ubuntu.com.