CVE-2026-66075

A flaw was found in RabbitMQ, a messaging and streaming broker. A remote attacker with monitoring user credentials can exploit an authorization flaw to restart federation links. This unauthorized action disrupts message flow, leading to a denial of service DoS for affected services. This...

CVE-2026-66075

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, isauthorized/2 for the /federation-links/.../restart route uses isauthorizedmonitor accepts the monitoring tag, while allowedmethods permits DELETE and deleteresource/2 triggers...

CVE-2026-66075

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, isauthorized/2 for the /federation-links/.../restart route uses isauthorizedmonitor accepts the monitoring tag, while allowedmethods permits DELETE and deleteresource/2 triggers...

EUVD-2026-85655

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, isauthorized/2 for the /federation-links/.../restart route uses isauthorizedmonitor accepts the monitoring tag, while allowedmethods permits DELETE and deleteresource/2 triggers...

CVE-2026-66075: Missing Authorization

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, isauthorized/2 for the /federation-links/.../restart route uses isauthorizedmonitor accepts the monitoring tag, while allowedmethods permits DELETE and deleteresource/2 triggers...

rabbitmq-server: RabbitMQ: Monitoring user can disrupt message flow via authorization flaw

A flaw was found in RabbitMQ, a messaging and streaming broker. A remote attacker with monitoring user credentials can exploit an authorization flaw to restart federation links. This unauthorized action disrupts message flow, leading to a denial of service DoS for affected services. This...

CVE-2026-57213: Improper Neutralization of Input During Web Page Generation

RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmqfederationmanagement plugin renders the consumertag field on the Federation Status page without HTML escaping, allowing a user who can configure a federation upstream or policy to execute...

RabbitMQ < 3.8.18 XSS

Pivotal RabbitMQ versions prior to 3.8.18 are affected by a cross-site scripting XSS vulnerability in the rabbitmqfederationmanagement plugin due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this, by convincing a user ...

CVE-2021-32719

RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI via the rabbitmqfederationmanagement plugin, its consumer tag was rendered without proper tag sanitization. This potentially allows for...

CVE-2021-32719: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI via the rabbitmqfederationmanagement plugin, its consumer tag was rendered without proper...