CVE-2026-18655

Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server awslabs.amazon-mq-mcp-server before 2.0.24 may allow a remote unauthenticated actor via prompt injection to obtain Amazon MQ for RabbitMQ broker credentials or OAuth access tokens sent t...

EUVD-2026-52406

Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server awslabs.amazon-mq-mcp-server before 2.0.24 may allow a remote unauthenticated actor via prompt injection to obtain Amazon MQ for RabbitMQ broker credentials or OAuth access tokens sent t...

CLEANSTART-2026-CC85180 Security fixes in rabbitmq-cluster-operator 2.20.0-r1

Package rabbitmq-cluster-operator version 2.20.0-r1 fixes 13 vulnerabilities: CVE-2026-27143, ghsa-pc3f-x583-g7j2, CVE-2026-32281, CVE-2026-32280, CVE-2026-32283...

CLEANSTART-2026-KV79736 Security fixes in rabbitmq-cluster-operator 2.19.2-r5

Package rabbitmq-cluster-operator version 2.19.2-r5 fixes 1 vulnerabilities: CVE-2026-42504...

CLEANSTART-2026-KH47666 Security fixes in rabbitmq-cluster-operator 2.20.1-r2

Package rabbitmq-cluster-operator version 2.20.1-r2 fixes 1 vulnerabilities: CVE-2026-42504...

CLEANSTART-2026-GI68088 Security fixes in rabbitmq-messaging-topology-operator 1.19.0-r0

Package rabbitmq-messaging-topology-operator version 1.19.0-r0 fixes 1 vulnerabilities: CVE-2026-33186...

CLEANSTART-2026-XE28379 Security fixes in rabbitmq-messaging-topology-operator 1.19.3-r0

Package rabbitmq-messaging-topology-operator version 1.19.3-r0 fixes 4 vulnerabilities: CVE-2026-46600, CVE-2026-56852, CVE-2026-39822, CVE-2026-42505...

CLEANSTART-2026-SA98192 Security fixes in rabbitmq-messaging-topology-operator 1.19.2-r0

Package rabbitmq-messaging-topology-operator version 1.19.2-r0 fixes 9 vulnerabilities: CVE-2026-27145, CVE-2026-42504, CVE-2026-42507, CVE-2026-25681, CVE-2026-27136...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: rabbitmq-server4.2: rabbitmq-server4.2-4.2.9-0.2.hum1 aarch64, x8664 rabbitmq-server4.2-4.2.9-0.2.hum1.src src Security Fixes: rabbitmq-server4.2: CVE-2026-59248 CVE-2026-65624...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: rabbitmq-server4.3: rabbitmq-server4.3-4.3.4-0.2.hum1 aarch64, x8664 rabbitmq-server4.3-4.3.4-0.2.hum1.src src Security Fixes: rabbitmq-server4.3: CVE-2026-59248 CVE-2026-65624...

CVE-2026-57220

A flaw was found in RabbitMQ. The stream listener in RabbitMQ does not properly enforce frame-size limits during authentication and before negotiation. This allows an unauthenticated remote client to send oversized stream frames, which can consume excessive broker memory. This can lead to a denia...

CVE-2026-57211

A flaw was found in RabbitMQ. The RabbitMQ management plugin static file handler, rabbitmgmtwmstatic, on Windows can be exploited when multiple management extension plugins are enabled. An attacker can pass specially crafted URL-encoded backslashes, bypassing path validation. This can lead to...

CVE-2026-57218

A flaw was found in RabbitMQ. An existing consumer in RabbitMQ AMQP 0-9-1 can continue to receive messages even after its OAuth token has expired or its connection's scopes have been reduced. This occurs because consumers are not properly canceled or reauthorized when the channel user state...

CVE-2026-57214

A flaw was found in RabbitMQ, a messaging and streaming broker. The RabbitMQ management user interface UI improperly handles the x-internal-purpose argument when rendering queue or exchange details. This vulnerability allows a user with permissions to declare a queue or exchange to inject and...

CVE-2026-57217

A flaw was found in RabbitMQ, a messaging and streaming broker. During metadata-store failures, the topic authorization mechanism can incorrectly allow restricted topic writes and binds. This occurs because permission lookup errors from Khepri are treated as an 'allow' condition by the internal...

CVE-2026-57213

A flaw was found in the RabbitMQ rabbitmqfederationmanagement plugin. This cross-site scripting XSS vulnerability occurs because the consumertag field on the Federation Status page does not properly escape HTML. A user with permissions to configure a federation upstream or policy can exploit this...

CVE-2026-57219

A flaw was found in RabbitMQ, a messaging and streaming broker. An unauthenticated remote attacker could exploit an obsolete API endpoint GET /api/auth to disclose the OAuth 2 client secret. This vulnerability occurs when the RabbitMQ management plugin and OAuth configuration are enabled, leading...

CVE-2026-57221

A flaw was found in RabbitMQ. This vulnerability allows an authenticated user, with the ability to connect to a virtual host, to bypass authorization checks during passive queue.declare and exchange.declare AMQP 0-9-1 Advanced Message Queuing Protocol operations. This bypass enables the user to...

CVE-2026-57212

A flaw was found in RabbitMQ, a messaging and streaming broker. A remote attacker could exploit this vulnerability by sending oversized JSON bodies to the rabbitmqmanagement HTTP API. The API's body size check is incomplete, allowing the final combined size to exceed limits. This could lead to a...

CVE-2026-57215

A flaw was found in RabbitMQ, a messaging and streaming broker. This vulnerability allows an attacker to establish persistent foreign bindings to reply-to destinations. This occurs because temporary queues are not properly removed, leaving behind active routing entries. This can lead to...