PatchSiren cyber security CVE debrief
CVE-2026-44839 rabbitmq CVE debrief
A medium-severity vulnerability in RabbitMQ messaging and streaming broker affects versions from 3.7.0 through 4.1.1 and 4.0.12. The issue, classified as CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page), has been addressed in versions 4.1.2 and 4.0.13. The CVSS 4.0 vector indicates network attack vector with high attack complexity, requiring high privileges and user interaction, with high confidentiality impact but no integrity or availability impact. The vulnerability was published to NVD on May 27, 2026, with vendor security advisory and patch commit available through GitHub.
- Vendor
- rabbitmq
- Product
- rabbitmq-server
- CVSS
- MEDIUM 5.6
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-27
- Original CVE updated
- 2026-06-04
- Advisory published
- 2026-05-27
- Advisory updated
- 2026-06-04
Who should care
Organizations running RabbitMQ messaging infrastructure, particularly those with administrative interfaces exposed to users with elevated privileges. Security teams responsible for message broker infrastructure and developers building applications on RabbitMQ should prioritize patching. Given the high privilege and user interaction requirements, risk is elevated for multi-tenant or shared administrative environments.
Technical summary
RabbitMQ versions from 3.7.0 through 4.1.1 and 4.0.12 contain an improper neutralization vulnerability (CWE-80) that could allow script-related HTML tag injection. The CVSS 4.0 score of 5.6 reflects network accessibility with high attack complexity, requiring high privileges and user interaction. Successful exploitation results in high confidentiality impact. The vulnerability has been patched in versions 4.1.2 and 4.0.13.
Defensive priority
medium
Recommended defensive actions
- Upgrade RabbitMQ to version 4.1.2 or 4.0.13 to remediate this vulnerability
- Review RabbitMQ deployment for versions between 3.7.0 and 4.1.1 or 4.0.12
- Monitor vendor security advisory for additional technical details as they become available
- Assess administrative access controls given high privilege requirements for exploitation
Evidence notes
CVE published 2026-05-27. Vendor advisory and patch commit confirmed via GitHub security advisories. CVSS 4.0 vector provided in NVD source. Fix versions explicitly stated in CVE description.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-44839 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-44839
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-44839 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-44839
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://github.com/rabbitmq/rabbitmq-server/commit/7f54319279d1ece161ae0b4cdc6f0e58a4045eb5
-
Source reference
Unverified legacy reference
URL: https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-fh5r-jpm3-fjwp
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.