CVE-2026-57214: RabbitMQ: Stored XSS in RabbitMQ management UI
RabbitMQ is a messaging and streaming broker. Prior to 4.2.5, the RabbitMQ management UI renders the x-internal-purpose queue or exchange argument into an HTML title attribute without proper escaping on the Queues and Exchanges pages, allowing a user with permission to declare a queue or exchange to execute JavaScript in another user's browser. This issue is fixed in version 4.2.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.2.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57214?
CVE-2026-57214 has a high severity rating of 7.1.
What type of vulnerability is CVE-2026-57214?
CVE-2026-57214 is a stored cross-site scripting (XSS) vulnerability.
How do I fix CVE-2026-57214?
To fix CVE-2026-57214, upgrade RabbitMQ to version 4.2.5 or later.
Who is affected by CVE-2026-57214?
Users of RabbitMQ management UI versions prior to 4.2.5 are affected by CVE-2026-57214.
What are the implications of CVE-2026-57214?
The implications of CVE-2026-57214 include the potential for an attacker to execute scripts in the context of the user's browser session.