Advisory ID:

TNZ-2026-0381

Severity:

[High]

Issue Date:

09-04-2026

Updated on:

Synopsis

Open Source RabbitMQ 3.13.19 resolves 7 security vulnerabilities:

• CVE-2026-67421 (medium): Stored HTML injection in RabbitMQ Management OAuth error handling
• GHSA-6gmw-wxch-cvvc (medium, CVE pending): Shovel URI credentials disclosed to read-only monitoring users via the shovel management HTTP API
• GHSA-6xpg-rfmh-grhq (medium, CVE pending): STOMP pre-authentication frame size limit is not enforced
• GHSA-3526-xvv4-q9mr (medium, CVE pending): RabbitMQ administrator RCE through reflected Erlang distribution authentication
• GHSA-27gv-h5q6-cpwg (low, CVE pending): RabbitMQ policymaker RCE through federation-management nonmember RPC and distribution reflection
• CVE-2026-67418 (low): MQTT 5.0 inapplicable PUBLISH property disconnects matching subscribers
• CVE-2026-67420 (low): OAuth credential refresh retains revoked runtime tags

https://nvd.nist.gov/vuln/detail/CVE-2026-67421

https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-6gmw-wxch-cvvc

https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-6xpg-rfmh-grhq

https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-3526-xvv4-q9mr

https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-27gv-h5q6-cpwg

https://nvd.nist.gov/vuln/detail/CVE-2026-67418

https://nvd.nist.gov/vuln/detail/CVE-2026-67420

Component

Vulnerabilities Resolved

Management Plugin (OAuth2 UI)

CVE-2026-67421 (medium)

Shovel Management Plugin

GHSA-6gmw-wxch-cvvc (medium)

STOMP Plugin

GHSA-6xpg-rfmh-grhq (medium)

Core (Erlang distribution)

GHSA-3526-xvv4-q9mr (medium)

Federation Management Plugin

GHSA-27gv-h5q6-cpwg (low)

MQTT Plugin

CVE-2026-67418 (low)

OAuth2 Plugin

CVE-2026-67420 (low)