CVE-2026-66077
Description
A flaw was found in RabbitMQ. This vulnerability, a stored Cross-Site Scripting (XSS), exists in the management UI. An attacker who can obtain a trusted TLS client certificate can embed malicious JavaScript in the certificate's Subject Distinguished Name (DN). When the TLS listener is configured for peer verification and an administrator views the connection in the management UI, the embedded script executes in the administrator's browser session, potentially leading to full account takeover.
Statement
This vulnerability is rated as an Important impact for Red Hat products because successful exploitation allows full administrative account takeover within the management console, even though exploitation demands specific mutual TLS preconditions and administrator interaction. The issue requires that the optional RabbitMQ management plugin is enabled, TLS listeners enforce client certificate peer verification, and an administrator views the affected connection details page. Exposure is limited to environments where trusted certificate authorities issue client certificates containing untrusted Subject names and administrators inspect active client connections through the web interface.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.7 | 6.1 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | Low | None | N/A |
| User Interaction | Required | Required | N/A |
| Scope | Changed | Changed | N/A |
| Confidentiality | High | Low | N/A |
| Integrity Impact | High | Low | N/A |
| Availability Impact | None | None | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
