CVE-2026-66077 rabbitmq CVE debrief

Who should care

RabbitMQ administrators and users, security teams, and developers using RabbitMQ in their applications should verify versions and configurations, assess exposure, and apply patches or mitigations as needed. This includes operators managing RabbitMQ deployments, platform teams responsible for securing the infrastructure, vulnerability management teams assessing exposure, and security teams monitoring for suspicious activity.

Why it matters

CVE-2026-66077 is a high-severity vulnerability in RabbitMQ that allows an attacker to embed JavaScript in a TLS client certificate's Subject DN, enabling full account takeover when an administrator views the connection detail page. RabbitMQ administrators and users, security teams, and developers using RabbitMQ in their applications should verify versions and configurations, assess exposure, and apply patches or mitigations as needed.

• Full account takeover by an attacker
• Execution of arbitrary JavaScript in administrator's browser session
• Potential for lateral movement and exploitation of other vulnerabilities

Technical summary

The RabbitMQ management UI uses EJS 1.0, which does not HTML-escape user input. An attacker can embed JavaScript in a TLS client certificate's Subject DN, allowing for full account takeover when an administrator views the connection detail page. The vulnerability affects RabbitMQ versions prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6. The management UI's CSP includes 'unsafe-inline', so inline script execution is not blocked. Preconditions include TLS listener configured with ssl_options.verify = verify_peer. Attacker can obtain a CA-signed client certificate with attacker-chosen Subject

Defensive priority

Administrators should verify RabbitMQ versions and configurations, assess exposure, and apply patches or mitigations as needed.

Recommended defensive actions

• Verify RabbitMQ version and configuration
• Assess exposure to vulnerable configurations
• Apply patches or mitigations as needed
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The management UI uses EJS 1.0, which does not HTML-escape user input, allowing an attacker to embed JavaScript in a TLS client certificate's Subject DN. RabbitMQ administrators and users, security teams, and developers using RabbitMQ in their applications should verify versions and configurations, assess exposure, and apply patches or mitigations as needed. The verifier corrected the original researcher's

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.