PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44839 rabbitmq CVE debrief

A medium-severity vulnerability in RabbitMQ messaging and streaming broker affects versions from 3.7.0 through 4.1.1 and 4.0.12. The issue, classified as CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page), has been addressed in versions 4.1.2 and 4.0.13. The CVSS 4.0 vector indicates network attack vector with high attack complexity, requiring high privileges and user interaction, with high confidentiality impact but no integrity or availability impact. The vulnerability was published to NVD on May 27, 2026, with vendor security advisory and patch commit available through GitHub.

Vendor
rabbitmq
Product
rabbitmq-server
CVSS
MEDIUM 5.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-04
Advisory published
2026-05-27
Advisory updated
2026-06-04

Who should care

Organizations running RabbitMQ messaging infrastructure, particularly those with administrative interfaces exposed to users with elevated privileges. Security teams responsible for message broker infrastructure and developers building applications on RabbitMQ should prioritize patching. Given the high privilege and user interaction requirements, risk is elevated for multi-tenant or shared administrative environments.

Technical summary

RabbitMQ versions from 3.7.0 through 4.1.1 and 4.0.12 contain an improper neutralization vulnerability (CWE-80) that could allow script-related HTML tag injection. The CVSS 4.0 score of 5.6 reflects network accessibility with high attack complexity, requiring high privileges and user interaction. Successful exploitation results in high confidentiality impact. The vulnerability has been patched in versions 4.1.2 and 4.0.13.

Defensive priority

medium

Recommended defensive actions

  • Upgrade RabbitMQ to version 4.1.2 or 4.0.13 to remediate this vulnerability
  • Review RabbitMQ deployment for versions between 3.7.0 and 4.1.1 or 4.0.12
  • Monitor vendor security advisory for additional technical details as they become available
  • Assess administrative access controls given high privilege requirements for exploitation

Evidence notes

CVE published 2026-05-27. Vendor advisory and patch commit confirmed via GitHub security advisories. CVSS 4.0 vector provided in NVD source. Fix versions explicitly stated in CVE description.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-44839 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-44839

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-44839 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-44839

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.