CVE-2026-57214highCWE-79

CVE-2026-57214: falha de alta gravidade em rabbitmq-server

RabbitMQ: Stored XSS in RabbitMQ management UI

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar rabbitmq-server+ Monitorar rabbitmq-server

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.2%
RabbitMQ is a messaging and streaming broker. Prior to 4.2.5, the RabbitMQ management UI renders the x-internal-purpose queue or exchange argument into an HTML title attribute without proper escaping on the Queues and Exchanges pages, allowing a user with permission to declare a queue or exchange to execute JavaScript in another user's browser. This issue is fixed in version 4.2.5.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
rabbitmq · rabbitmq-server
CVEs relacionadas — rabbitmq-server

No mesmo produto, das mais perigosas para as menos.

CVE-2026-57219HIGHRabbitMQ: Unauthenticated disclosure of OAuth client credentials via an HTTP API endpoint with certain less common OAuth 2 configurationsEPSS 2.8%CVE-2021-32718LOWImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ management UIEPSS 1.4%CVE-2021-32719LOWImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ federation management pluginEPSS 1.4%CVE-2023-46118MEDIUMDenial of Service by publishing large messages over the HTTP APIEPSS 1.3%CVE-2026-67414MEDIUMRabbitMQ AMQP 1.0 parser: amplification memory-exhaustion DoS via zero-width array aggregationEPSS 0.6%CVE-2026-57211MEDIUMRabbitMQ: UNC SSRF affecting the management UI on WindowsEPSS 0.6%