CVE-2026-67421

Description

RabbitMQ Management renders an AMQP authorization-error reason as HTML when the OAuth management UI is enabled. A user who can configure a queue can place an HTML `<base>` element in the queue name. If a management administrator who can see that queue but lacks AMQP read permission clicks **Get Message(s)**, the queue name is returned in an `ACCESS_REFUSED` reason and inserted into the page without HTML escaping. The default Content Security Policy blocks inline script execution in the current source, but it does not define `base-uri` or `connect-src`. An injected `<base>` element can therefore change the document base URL. The next automatic relative management API refresh is sent to an attacker-controlled CORS endpoint with the victim's explicit `Authorization` header. The result is theft of a management administrator's Basic or Bearer credential and subsequent control of RabbitMQ through the management API. The demonstrated chain does not provide broker-host code execution or arbitrary file access.

CVSS Base Scores

Affected Products

References

• https://www.cve.org/CVERecord?id=CVE-2026-67421