Every CVE Search/ Get API key

CVE-2026-67405

RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation)

5.3 MediumFix available

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler (deps/rabbitmq_web_mqtt/src/rabbit_web_mqtt_handler.erl:104) nor the Web-STOMP handler (deps/rabbitmq_web_stomp/src/rabbit_web_stomp_handler.erl:102) validates the Origin header on the WebSocket upgrade. Under ssl_cert_login=true, the browser presents the client certificate automatically, so an attacker's JavaScript running in the victim's browser can authenticate as the victim. Preconditions include The non-default configuration use_http_auth=true (Web-STOMP) or ssl_cert_login=true (both plugins) must be enabled. The issue is harmless under the default in-band CONNECT credential configuration.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
None

Exploit likelihood

0.11%Unchanged since Sep 24, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.3

RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation)

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler (deps/rabbitmq_web_mqtt/src/rabbit_web_mqtt_handler.erl:104) nor the Web-STOMP handler (deps/rabbitmq_web_stomp/src/rabbit_web_stomp_handler.erl:102) validates the Origin header on the WebSocket upgrade. Under ssl_cert_login=true, the browser presents the client certificate automatically, so an attacker's JavaScript running in the victim's browser can authenticate as the victim. Preconditions include The non-default configuration use_http_auth=true (Web-STOMP) or ssl_cert_login=true (both plugins) must be enabled. The issue is harmless under the default in-band CONNECT credential configuration.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

Record
CVE-2026-67405
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Weakness
CWE-1385
Updated
2026-11-02
EUVDEUVD-2026-85656 5.3

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler (deps/rabbitmq_web_mqtt/src/rabbit_web_mqtt_handler.erl:104) nor the Web-STOMP handler (deps/rabbitmq_web_stomp/src/rabbit_web_stomp_handler.erl:102) validates the Origin header on the WebSocket upgrade. Under ssl_cert_login=true, the browser presents the client certificate automatically, so an attacker's JavaScript running in the victim's browser can authenticate as the victim. Preconditions include The non-default configuration use_http_auth=true (Web-STOMP) or ssl_cert_login=true (both plugins) must be enabled. The issue is harmless under the default in-band CONNECT credential configuration.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

Record
EUVD-2026-85656
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Updated
2026-11-02
NVD 5.3

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler (deps/rabbitmq_web_mqtt/src/rabbit_web_mqtt_handler.erl:104) nor the Web-STOMP handler (deps/rabbitmq_web_stomp/src/rabbit_web_stomp_handler.erl:102) validates the Origin header on the WebSocket upgrade. Under ssl_cert_login=true, the browser presents the client certificate automatically, so an attacker's JavaScript running in the victim's browser can authenticate as the victim. Preconditions include The non-default configuration use_http_auth=true (Web-STOMP) or ssl_cert_login=true (both plugins) must be enabled. The issue is harmless under the default in-band CONNECT credential configuration.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

Record
CVE-2026-67405
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weakness
CWE-1385
Updated
2026-11-02
OSV 5.3

RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation)

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler (deps/rabbitmq_web_mqtt/src/rabbit_web_mqtt_handler.erl:104) nor the Web-STOMP handler (deps/rabbitmq_web_stomp/src/rabbit_web_stomp_handler.erl:102) validates the Origin header on the WebSocket upgrade. Under ssl_cert_login=true, the browser presents the client certificate automatically, so an attacker's JavaScript running in the victim's browser can authenticate as the victim. Preconditions include The non-default configuration use_http_auth=true (Web-STOMP) or ssl_cert_login=true (both plugins) must be enabled. The issue is harmless under the default in-band CONNECT credential configuration.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

Record
CVE-2026-67405
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Weakness
CWE-1385
Updated
2026-11-02
OSVDEBIAN-CVE-2026-67405 8.1

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler (deps/rabbitmq_web_mqtt/src/rabbit_web_mqtt_handler.erl:104) nor the Web-STOMP handler (deps/rabbitmq_web_stomp/src/rabbit_web_stomp_handler.erl:102) validates the Origin header on the WebSocket upgrade. Under ssl_cert_login=true, the browser presents the client certificate automatically, so an attacker's JavaScript running in the victim's browser can authenticate as the victim. Preconditions include The non-default configuration use_http_auth=true (Web-STOMP) or ssl_cert_login=true (both plugins) must be enabled. The issue is harmless under the default in-band CONNECT credential configuration.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

Record
DEBIAN-CVE-2026-67405
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:67552 8.7

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:67552
CVSS 3.1
8.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-67405 5.3

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler (deps/rabbitmq_web_mqtt/src/rabbit_web_mqtt_handler.erl:104) nor the Web-STOMP handler (deps/rabbitmq_web_stomp/src/rabbit_web_stomp_handler.erl:102) validates the Origin header on the WebSocket upgrade. Under ssl_cert_login=true, the browser presents the client certificate automatically, so an attacker's JavaScript running in the victim's browser can authenticate as the victim. Preconditions include The non-default configuration use_http_auth=true (Web-STOMP) or ssl_cert_login=true (both plugins) must be enabled. The issue is harmless under the default in-band CONNECT credential configuration.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

Record
UBUNTU-CVE-2026-67405
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVAZL-105747 No score

CVE-2026-67405 affecting package rabbitmq-server 3.13.7-9

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler (deps/rabbitmq_web_mqtt/src/rabbit_web_mqtt_handler.erl:104) nor the Web-STOMP handler (deps/rabbitmq_web_stomp/src/rabbit_web_stomp_handler.erl:102) validates the Origin header on the WebSocket upgrade. Under ssl_cert_login=true, the browser presents the client certificate automatically, so an attacker's JavaScript running in the victim's browser can authenticate as the victim. Preconditions include The non-default configuration use_http_auth=true (Web-STOMP) or ssl_cert_login=true (both plugins) must be enabled. The issue is harmless under the default in-band CONNECT credential configuration.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

Record
AZL-105747
Updated
2026-11-02
OSVBIT-rabbitmq-2026-67405 No score

RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation)

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler (deps/rabbitmq_web_mqtt/src/rabbit_web_mqtt_handler.erl:104) nor the Web-STOMP handler (deps/rabbitmq_web_stomp/src/rabbit_web_stomp_handler.erl:102) validates the Origin header on the WebSocket upgrade. Under ssl_cert_login=true, the browser presents the client certificate automatically, so an attacker's JavaScript running in the victim's browser can authenticate as the victim. Preconditions include The non-default configuration use_http_auth=true (Web-STOMP) or ssl_cert_login=true (both plugins) must be enabled. The issue is harmless under the default in-band CONNECT credential configuration.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

Record
BIT-rabbitmq-2026-67405
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rabbitmq-server
Azure Linux:3
 through 3.13.7-9 None known
rabbitmq
Bitnami
 3.13.0 up to 3.13.15, 4.0.0 up to 4.0.20, 4.1.0 up to 4.1.11, 4.2.0 up to 4.2.6
3.13.154.0.204.1.114.2.6
rabbitmq-server
Debian:12
 All versions, plus listed versions
3.10.8-1.13.10.8-1.1+deb12u13.10.8-23.10.8-33.10.8-4
Show 24 moreShow less
3.12.1-13.12.1-1.14.0.5-14.0.5-104.0.5-114.0.5-124.0.5-134.0.5-144.0.5-24.0.5-34.0.5-44.0.5-54.0.5-64.0.5-84.0.5-94.3.0-14.3.0-24.3.0-34.3.2-14.3.2-24.3.2-34.3.2-44.3.2-54.3.6-1
 None known
rabbitmq-server
Debian:13
 All versions, plus listed versions
4.0.5-104.0.5-114.0.5-124.0.5-134.0.5-14
Show 14 moreShow less
4.0.5-64.0.5-6+deb13u14.0.5-6+deb13u24.0.5-84.0.5-94.3.0-14.3.0-24.3.0-34.3.2-14.3.2-24.3.2-34.3.2-44.3.2-54.3.6-1
 None known
rabbitmq-server
Debian:14
 before 4.3.0-2, plus listed versions
4.0.5-104.0.5-114.0.5-124.0.5-134.0.5-14
Show 4 moreShow less
4.0.5-64.0.5-84.0.5-94.3.0-1
4.3.0-2
rabbitmq-server4.3
Red Hat:hummingbird:1
From an advisory covering 54 CVEs
 before 0:4.3.6-1.hum1
0:4.3.6-1.hum1
rabbitmq-server
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.5.4-13.5.4-33.5.4-3.13.5.7-13.5.7-1ubuntu0.16.04.1
Show 5 moreShow less
3.5.7-1ubuntu0.16.04.23.5.7-1ubuntu0.16.04.43.5.7-1ubuntu0.16.04.4+esm13.5.7-1ubuntu0.16.04.4+esm23.5.7-1ubuntu0.16.04.4+esm3
 None known
rabbitmq-server
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.6.10-13.6.10-1ubuntu0.13.6.10-1ubuntu0.33.6.10-1ubuntu0.43.6.10-1ubuntu0.53.6.10-1ubuntu0.5+esm1
 None known
rabbitmq-server
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
3.7.8-4ubuntu23.7.18-13.8.2-0ubuntu13.8.2-0ubuntu1.13.8.2-0ubuntu1.2
Show 8 moreShow less
3.8.2-0ubuntu1.33.8.2-0ubuntu1.43.8.2-0ubuntu1.53.8.3-0ubuntu0.13.8.3-0ubuntu0.23.8.3-0ubuntu0.33.8.3-0ubuntu0.3+esm13.8.3-0ubuntu0.3+esm2
 None known
rabbitmq-server
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.8.9-3ubuntu13.9.8-13.9.8-23.9.8-33.9.8-5
Show 8 moreShow less
3.9.8-63.9.13-13.9.13-1ubuntu0.22.04.13.9.13-1ubuntu0.22.04.23.9.27-0ubuntu0.13.9.27-0ubuntu0.23.9.27-0ubuntu0.53.9.27-0ubuntu0.6
 None known
rabbitmq-server
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.12.1-13.12.1-1ubuntu13.12.1-1ubuntu1.23.12.1-1ubuntu1.43.12.1-1ubuntu1.63.12.1-1ubuntu1.7
 None known
rabbitmq-server
Ubuntu:26.04:LTS
 All versions, plus listed versions
4.0.5-8ubuntu24.0.5-10ubuntu14.0.5-10ubuntu24.0.5-10ubuntu34.0.5-10ubuntu44.0.5-10ubuntu54.0.5-10ubuntu5.14.0.5-10ubuntu5.2
 None known

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-67405 is a medium vulnerability (CVSS 5.3) in Broadcom Rabbitmq Server, published September 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.11%, the 1st percentile. Fixed in rabbitmq 3.13.15.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 124 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open