1458 matches found
CVE-2026-18655
Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server awslabs.amazon-mq-mcp-server before 2.0.24 may allow a remote unauthenticated actor via prompt injection to obtain Amazon MQ for RabbitMQ broker credentials or OAuth access tokens sent t...
EUVD-2026-52406
Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server awslabs.amazon-mq-mcp-server before 2.0.24 may allow a remote unauthenticated actor via prompt injection to obtain Amazon MQ for RabbitMQ broker credentials or OAuth access tokens sent t...
CLEANSTART-2026-SA98192 Security fixes in rabbitmq-messaging-topology-operator 1.19.2-r0
Package rabbitmq-messaging-topology-operator version 1.19.2-r0 fixes 9 vulnerabilities: CVE-2026-27145, CVE-2026-42504, CVE-2026-42507, CVE-2026-25681, CVE-2026-27136...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: rabbitmq-server4.2: rabbitmq-server4.2-4.2.9-0.2.hum1 aarch64, x8664 rabbitmq-server4.2-4.2.9-0.2.hum1.src src Security Fixes: rabbitmq-server4.2: CVE-2026-59248 CVE-2026-65624...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: rabbitmq-server4.3: rabbitmq-server4.3-4.3.4-0.2.hum1 aarch64, x8664 rabbitmq-server4.3-4.3.4-0.2.hum1.src src Security Fixes: rabbitmq-server4.3: CVE-2026-59248 CVE-2026-65624...
CVE-2026-57220
A flaw was found in RabbitMQ. The stream listener in RabbitMQ does not properly enforce frame-size limits during authentication and before negotiation. This allows an unauthenticated remote client to send oversized stream frames, which can consume excessive broker memory. This can lead to a denia...
CVE-2026-57211
A flaw was found in RabbitMQ. The RabbitMQ management plugin static file handler, rabbitmgmtwmstatic, on Windows can be exploited when multiple management extension plugins are enabled. An attacker can pass specially crafted URL-encoded backslashes, bypassing path validation. This can lead to...
CVE-2026-57218
A flaw was found in RabbitMQ. An existing consumer in RabbitMQ AMQP 0-9-1 can continue to receive messages even after its OAuth token has expired or its connection's scopes have been reduced. This occurs because consumers are not properly canceled or reauthorized when the channel user state...
CVE-2026-57214
A flaw was found in RabbitMQ, a messaging and streaming broker. The RabbitMQ management user interface UI improperly handles the x-internal-purpose argument when rendering queue or exchange details. This vulnerability allows a user with permissions to declare a queue or exchange to inject and...
CVE-2026-57217
A flaw was found in RabbitMQ, a messaging and streaming broker. During metadata-store failures, the topic authorization mechanism can incorrectly allow restricted topic writes and binds. This occurs because permission lookup errors from Khepri are treated as an 'allow' condition by the internal...
CVE-2026-57213
A flaw was found in the RabbitMQ rabbitmqfederationmanagement plugin. This cross-site scripting XSS vulnerability occurs because the consumertag field on the Federation Status page does not properly escape HTML. A user with permissions to configure a federation upstream or policy can exploit this...
CVE-2026-57219
A flaw was found in RabbitMQ, a messaging and streaming broker. An unauthenticated remote attacker could exploit an obsolete API endpoint GET /api/auth to disclose the OAuth 2 client secret. This vulnerability occurs when the RabbitMQ management plugin and OAuth configuration are enabled, leading...
CVE-2026-57221
A flaw was found in RabbitMQ. This vulnerability allows an authenticated user, with the ability to connect to a virtual host, to bypass authorization checks during passive queue.declare and exchange.declare AMQP 0-9-1 Advanced Message Queuing Protocol operations. This bypass enables the user to...
CVE-2026-57212
A flaw was found in RabbitMQ, a messaging and streaming broker. A remote attacker could exploit this vulnerability by sending oversized JSON bodies to the rabbitmqmanagement HTTP API. The API's body size check is incomplete, allowing the final combined size to exceed limits. This could lead to a...
CVE-2026-57215
A flaw was found in RabbitMQ, a messaging and streaming broker. This vulnerability allows an attacker to establish persistent foreign bindings to reply-to destinations. This occurs because temporary queues are not properly removed, leaving behind active routing entries. This can lead to...
rabbitmq-server: RabbitMQ: Authorization bypass via regular expression injection in MQTT client ID
A flaw was found in RabbitMQ. An authenticated MQTT Message Queuing Telemetry Transport user can bypass topic-level authorization by injecting regular expression operators. This occurs because the client ID, provided by the user in the MQTT CONNECT packet, is inserted into authorization regex...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: rabbitmq-server4.3: rabbitmq-server4.3-4.3.4-0.1.hum1 aarch64, x8664 rabbitmq-server4.3-4.3.4-0.1.hum1.src src...
PYSEC-2026-3492 OpenStack oslo.messaging does not verify RabbitMQ broker hostname during TLS handshake
An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. The oslo.messaging RabbitMQ driver does not perform TLS hostname verification when connecting to the message broker. When sslcafile is configured, the driver enables certificate chain validation but does not pass the expect...
OpenStack oslo.messaging does not verify RabbitMQ broker hostname during TLS handshake
An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. The oslo.messaging RabbitMQ driver does not perform TLS hostname verification when connecting to the message broker. When sslcafile is configured, the driver enables certificate chain validation but does not pass the expect...
