CVE-2025-30219mediumCWE-79

CVE-2025-30219: medium-severity vulnerability in rabbitmq-server

RabbitMQ has XSS Vulnerability in an Error Message in Management UI

Published · Updated

Follow this CVE+ Monitor rabbitmq-server+ Monitor rabbitmq-server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.1epss 0.2%
RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users. When a virtual host on a RabbitMQ node fails to start, recent versions will display an error message (a notification) in the management UI. The error message includes virtual host name, which was not escaped prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an existing virtual host on disk could trigger arbitrary JavaScript code execution in the management UI (the user's browser). Open source RabbitMQ `4.0.3` and Tanzu RabbitMQ `4.0.3` and `3.13.8` patch the issue.
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:L
Affected products
rabbitmq · rabbitmq-server
Related CVEs — rabbitmq-server

In the same product, most dangerous first.

CVE-2026-57219HIGHRabbitMQ: Unauthenticated disclosure of OAuth client credentials via an HTTP API endpoint with certain less common OAuth 2 configurationsEPSS 2.8%CVE-2021-32718LOWImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ management UIEPSS 1.4%CVE-2021-32719LOWImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ federation management pluginEPSS 1.4%CVE-2023-46118MEDIUMDenial of Service by publishing large messages over the HTTP APIEPSS 1.3%CVE-2026-67414MEDIUMRabbitMQ AMQP 1.0 parser: amplification memory-exhaustion DoS via zero-width array aggregationEPSS 0.6%CVE-2026-57211MEDIUMRabbitMQ: UNC SSRF affecting the management UI on WindowsEPSS 0.6%