CVE-2026-67405

RabbitMQ messaging and streaming broker versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 are vulnerable to a Cross-Site WebSocket Hijacking (CSWH) attack. The Web-MQTT handler and Web-STOMP handler fail to validate the Origin header during a WebSocket upgrade. If non-default configurat...