RabbitMQ: AMQP 1.0, AMQP 0-9-1, Stream Protocol loopback enforcement can lead to remote guest sessions due to listener-address loopback checks

RabbitMQ: UNC SSRF affecting the management UI on Windows

An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7

RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint

RabbitMQ: Trust-store whitelist by Issuer+Serial only

RabbitMQ: CORS * reflects Origin with Allow-Credentials

RabbitMQ: Direct-reply-to binding persistence can lead to unauthorized reply-channel injection and persistent phantom

RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation)

RabbitMQ MQTT Topic Permission Authorization Bypass

RabbitMQ installers on Windows prior to version 3.8.16 do not harden plugin directory permissions, potentially allowing attackers with sufficient local filesystem permissions to…

An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all…

RabbitMQ management HTTP API accepts request bodies larger than configured max_http_body_size

RabbitMQ: Stream-protocol frame length never validated against frame_max

RabbitMQ: Web-STOMP unbounded pre-auth accumulation

RabbitMQ: Web-MQTT decompression bomb

RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS

RabbitMQ: Unauthenticated disclosure of OAuth client credentials via an HTTP API endpoint with certain less common OAuth 2 configurations

RabbitMQ: Stream listener does not enforce configured frame-size limit during authentication, permitting unauth'd mem-exhaust DoS

Predictable credential obfuscation seed value used in rabbitmq-server

Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4,…

RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch

RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint

RabbitMQ: Incomplete fix for CVE-2026-44838: `escape_regex_char/1` does not escape `-`, leaving room for an MQTT topic permission bypass

RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass

RabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message access

RabbitMQ: LDAP DN injection via unescaped substitution

RabbitMQ: Monitoring-tag user can DELETE shovels

RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling

RabbitMQ versions 3.8.x prior to 3.8.7 are prone to a Windows-specific binary planting security vulnerability that allows for arbitrary code execution

RabbitMQ OAuth credential refresh retains revoked runtime tags

RabbitMQ: Consecutive topic wildcards cause combinatorial routing work

RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service

RabbitMQ: Federation and Shovel Gen-Servers Lack format_status Callback — Plaintext Credentials Exposed in Crash Dumps and sys:get_status

RabbitMQ: Authenticated RabbitMQ JMS Topic Selector Users Can Consume Broker CPU with an Unbounded LIKE Regular Expression

RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS

RabbitMQ: AMQP 1.0 management exchange.declare skips alternate-exchange permission check

RabbitMQ: Atom exhaustion: OAuth2 JWT tag: scope values

RabbitMQ: Atom table exhaustion via management API node field

RabbitMQ: list_to_atom on auth_mechanism URI tokens in amqp_client

RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login

RabbitMQ: Super-stream HTTP creation skips configure-permission check

RabbitMQ: ReDoS via management API ?name= filter

RabbitMQ: Consistent-hash exchange unbounded weight

RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size

RabbitMQ: Atom table exhaustion via stream `chunk_selector`

RabbitMQ: JMS topic exchange erl_scan atom exhaustion

RabbitMQ: Cross-vhost quorum-queue status and stream tracking disclosure

RabbitMQ: Topic authorization can lead to cross-tenant routing-key bypass

RabbitMQ: AMQP 0-9-1 in combination with OAuth 2: consumer persistence can lead to post-revocation message disclosure

RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI