USN-8933-1: RabbitMQ Server vulnerabilities
It was discovered that RabbitMQ Server incorrectly handled CORS wildcard
origin configuration. An attacker could possibly use this issue to cause
a cross-site request forgery attack. This issue only affected Ubuntu 18.04
LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04
LTS. (CVE-2026-66070)
It was discovered that RabbitMQ Server incorrectly handled TLS
peer-certificate DNs in the management UI. An attacker could possibly use
this issue to cause a cross-site scripting attack. (CVE-2026-66077)
It was discovered that RabbitMQ Server incorrectly handled AMQP 1.0 arrays
with zero-width element constructors. An attacker could possibly use this
issue to cause a denial of service. This issue only affected Ubuntu 20.04
LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-66079)
It was discovered that RabbitMQ Server trust-store plugin incorrectly
validated client certificates. An attacker could possibly use this issue to
bypass TLS client authentication. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-67231)
It was discovered that RabbitMQ Server incorrectly handled WebSocket frame
sizes. An attacker could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,
Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67232)
It was discovered that RabbitMQ Server incorrectly handled content-header
body sizes. An attacker could possibly use this issue to cause a denial of
service. (CVE-2026-67235)
It was discovered that RabbitMQ Server incorrectly stored credentials in an
insecure cookie. An attacker could possibly use this issue to expose
sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu
22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67236)
It was discovered that RabbitMQ Server incorrectly handled OAuth bearer
tokens in bootstrap JavaScript. An attacker could possibly use this issue
to cause a cross-site scripting attack. This issue only affected Ubuntu
24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-67237)
It was discovered that RabbitMQ Server incorrectly handled ETF-encoded PID
node names. An attacker could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and
Ubuntu 26.04 LTS. (CVE-2026-67238)
It was discovered that RabbitMQ Server incorrectly handled TLS
peer-certificate DNs in the stream management UI. An attacker could
possibly use this issue to cause a cross-site scripting attack. This issue
only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-67239)
It was discovered that RabbitMQ Server incorrectly handled OAuth2 SSL
options when no CA certificates were available. An attacker could possibly
use this issue to bypass TLS verification. This issue only affected Ubuntu
26.04 LTS. (CVE-2026-67404)
It was discovered that RabbitMQ Server incorrectly validated HTTP response
status codes when fetching JWKS keys. An attacker could possibly use this
issue to cause a denial of service. This issue only affected Ubuntu 22.04
LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67409)