All vulnerabilities
CVE-2026-67234GHSA-q286-p3m9-j69f

rabbitmq-server: RabbitMQ: Non-RFC-conformant cookie name when clearing the auth-mechanism preference

rabbitmq rabbitmq-server
Open in ThreatlineRecord JSON
CVSS
2.3Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.43%Chance of exploitation activity in the next 30 days, higher than 35% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.2.8Also 4.3.2GitHub
Published25 Sep 2026Updated 25 Sep 2026CVE List

What fixes it

  • 4.2.8rabbitmq-server, otherGitHub
  • 4.3.2rabbitmq-server, otherGitHub

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, get_auth_mechanism/1 used term_to_binary/1 on the strict_auth_mechanism or preferred_auth_mechanism atom when clearing the corresponding cookie, producing a non-ASCII cookie name that violates RFC 6265 and can prevent the browser from deleting the preference. The issue is not directly exploitable for code execution or data exfiltration; its security relevance is limited to stale authentication-mechanism preferences persisting across logout and login cycles. This issue is fixed in versions 4.2.8 and 4.3.2.

Text from CVE List

Affected versions 4

  • rabbitmq-serveraffected: >= 4.2.0, < 4.2.8CVE List
  • rabbitmq-serveraffected: >= 4.3.0, < 4.3.2CVE List
  • rabbitmq-server, other>= 4.2.0, < 4.2.8GitHub
  • rabbitmq-server, other>= 4.3.0, < 4.3.2GitHub

References 5