Home / mailings [USN-8933-1] RabbitMQ Server vulnerabilities
Posted on 16 October 2026
Ubuntu Security==========================================================================Ubuntu Security Notice USN-8933-1
October 15, 2026
rabbitmq-server vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in RabbitMQ Server.
Software Description:
- rabbitmq-server: AMQP server written in Erlang
Details:
It was discovered that RabbitMQ Server incorrectly handled CORS wildcard
origin configuration. An attacker could possibly use this issue to cause
a cross-site request forgery attack. This issue only affected Ubuntu 18.04
LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04
LTS. (CVE-2026-66070)
It was discovered that RabbitMQ Server incorrectly handled TLS
peer-certificate DNs in the management UI. An attacker could possibly use
this issue to cause a cross-site scripting attack. (CVE-2026-66077)
It was discovered that RabbitMQ Server incorrectly handled AMQP 1.0 arrays
with zero-width element constructors. An attacker could possibly use this
issue to cause a denial of service. This issue only affected Ubuntu 20.04
LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-66079)
It was discovered that RabbitMQ Server trust-store plugin incorrectly
validated client certificates. An attacker could possibly use this issue to
bypass TLS client authentication. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-67231)
It was discovered that RabbitMQ Server incorrectly handled WebSocket frame
sizes. An attacker could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,
Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67232)
It was discovered that RabbitMQ Server incorrectly handled content-header
body sizes. An attacker could possibly use this issue to cause a denial of
service. (CVE-2026-67235)
It was discovered that RabbitMQ Server incorrectly stored credentials in an
insecure cookie. An attacker could possibly use this issue to expose
sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu
22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67236)
It was discovered that RabbitMQ Server incorrectly handled OAuth bearer
tokens in bootstrap JavaScript. An attacker could possibly use this issue
to cause a cross-site scripting attack. This issue only affected Ubuntu
24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-67237)
It was discovered that RabbitMQ Server incorrectly handled ETF-encoded PID
node names. An attacker could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and
Ubuntu 26.04 LTS. (CVE-2026-67238)
It was discovered that RabbitMQ Server incorrectly handled TLS
peer-certificate DNs in the stream management UI. An attacker could
possibly use this issue to cause a cross-site scripting attack. This issue
only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-67239)
It was discovered that RabbitMQ Server incorrectly handled OAuth2 SSL
options when no CA certificates were available. An attacker could possibly
use this issue to bypass TLS verification. This issue only affected Ubuntu
26.04 LTS. (CVE-2026-67404)
It was discovered that RabbitMQ Server incorrectly validated HTTP response
status codes when fetching JWKS keys. An attacker could possibly use this
issue to cause a denial of service. This issue only affected Ubuntu 22.04
LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67409)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 26.04 LTS
rabbitmq-server 4.0.5-10ubuntu5.2
Ubuntu 24.04 LTS
rabbitmq-server 3.12.1-1ubuntu1.7
Ubuntu 22.04 LTS
rabbitmq-server 3.9.27-0ubuntu0.6
Ubuntu 20.04 LTS
rabbitmq-server 3.8.3-0ubuntu0.3+esm2
Available with Ubuntu Pro
Ubuntu 18.04 LTS
rabbitmq-server 3.6.10-1ubuntu0.5+esm1
Available with Ubuntu Pro
Ubuntu 16.04 LTS
rabbitmq-server 3.5.7-1ubuntu0.16.04.4+esm3
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
After a standard system update you need to restart rabbitmq-server to make
all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-8933-1
CVE-2026-66070, CVE-2026-66077, CVE-2026-66079, CVE-2026-67231,
CVE-2026-67232, CVE-2026-67235, CVE-2026-67236, CVE-2026-67237,
CVE-2026-67238, CVE-2026-67239, CVE-2026-67404, CVE-2026-67409
Package Information:
https://launchpad.net/ubuntu/+source/rabbitmq-server/4.0.5-10ubuntu5.2
https://launchpad.net/ubuntu/+source/rabbitmq-server/3.12.1-1ubuntu1.7
https://launchpad.net/ubuntu/+source/rabbitmq-server/3.9.27-0ubuntu0.6
--===============3191695687596521083==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
