CVE-2026-67236

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-67236", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-28T19:50:39.438Z", "datePublished": "2026-09-25T15:59:10.275Z", "dateUpdated": "2026-09-28T13:41:39.055Z"}, "containers": {"cna": {"title": "RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login", "problemTypes": [{"descriptions": [{"cweId": "CWE-312", "lang": "en", "description": "CWE-312: Cleartext Storage of Sensitive Information", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-88vh-gx85-p36m", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-88vh-gx85-p36m"}, {"name": "https://github.com/rabbitmq/rabbitmq-server/commit/df9e7f4c0afd311a672705f020d301efad355745", "tags": ["x_refsource_MISC"], "url": "https://github.com/rabbitmq/rabbitmq-server/commit/df9e7f4c0afd311a672705f020d301efad355745"}, {"name": "https://github.com/rabbitmq/rabbitmq-server/commit/edf1fbc7217aaf736955d2e13c9534901a2e0778", "tags": ["x_refsource_MISC"], "url": "https://github.com/rabbitmq/rabbitmq-server/commit/edf1fbc7217aaf736955d2e13c9534901a2e0778"}, {"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.8", "tags": ["x_refsource_MISC"], "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.8"}, {"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.2"}], "affected": [{"vendor": "rabbitmq", "product": "rabbitmq-server", "versions": [{"version": ">= 4.2.0, < 4.2.8", "status": "affected"}, {"version": ">= 4.3.0, < 4.3.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-25T15:59:10.275Z"}, "descriptions": [{"lang": "en", "value": "RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused is_authorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding rather than encryption, an attacker with same-origin cross-site scripting, an HTTP-readable network position, or local access to the browser cookie store could recover the actual login credentials; older browsers that treated an absent SameSite attribute as None also sent the cookie cross-site. This issue is fixed in versions 4.2.8 and 4.3.2."}], "source": {"advisory": "GHSA-88vh-gx85-p36m", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-28T13:41:31.815135Z", "id": "CVE-2026-67236", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-28T13:41:39.055Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-67236", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-28T13:41:31.815135Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-28T13:41:35.575Z"}}], "cna": {"title": "RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login", "source": {"advisory": "GHSA-88vh-gx85-p36m", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "rabbitmq", "product": "rabbitmq-server", "versions": [{"status": "affected", "version": ">= 4.2.0, < 4.2.8"}, {"status": "affected", "version": ">= 4.3.0, < 4.3.2"}]}], "references": [{"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-88vh-gx85-p36m", "name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-88vh-gx85-p36m", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/rabbitmq/rabbitmq-server/commit/df9e7f4c0afd311a672705f020d301efad355745", "name": "https://github.com/rabbitmq/rabbitmq-server/commit/df9e7f4c0afd311a672705f020d301efad355745", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rabbitmq/rabbitmq-server/commit/edf1fbc7217aaf736955d2e13c9534901a2e0778", "name": "https://github.com/rabbitmq/rabbitmq-server/commit/edf1fbc7217aaf736955d2e13c9534901a2e0778", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.8", "name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.8", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.2", "name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused is_authorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding rather than encryption, an attacker with same-origin cross-site scripting, an HTTP-readable network position, or local access to the browser cookie store could recover the actual login credentials; older browsers that treated an absent SameSite attribute as None also sent the cookie cross-site. This issue is fixed in versions 4.2.8 and 4.3.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-312", "description": "CWE-312: Cleartext Storage of Sensitive Information"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-25T15:59:10.275Z"}}}, "cveMetadata": {"cveId": "CVE-2026-67236", "state": "PUBLISHED", "dateUpdated": "2026-09-28T13:41:39.055Z", "dateReserved": "2026-07-28T19:50:39.438Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-09-25T15:59:10.275Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "rabbitmq-server", "vendor": "rabbitmq", "versions": [{"status": "affected", "version": ">= 4.2.0, < 4.2.8"}, {"status": "affected", "version": ">= 4.3.0, < 4.3.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "7D4107E2-55ED-4D10-B647-E89B9B572F08", "versionEndExcluding": "4.2.8", "versionStartIncluding": "4.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "E0BFA770-90AD-4D95-A0E1-A3D973C500D2", "versionEndExcluding": "4.3.2", "versionStartIncluding": "4.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused is_authorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding rather than encryption, an attacker with same-origin cross-site scripting, an HTTP-readable network position, or local access to the browser cookie store could recover the actual login credentials; older browsers that treated an absent SameSite attribute as None also sent the cookie cross-site. This issue is fixed in versions 4.2.8 and 4.3.2."}], "id": "CVE-2026-67236", "lastModified": "2026-10-15T20:24:24.710", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67236", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-28T13:41:31.815135Z", "version": "2.0.3"}}]}, "published": "2026-09-25T16:17:27.053", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/rabbitmq/rabbitmq-server/commit/df9e7f4c0afd311a672705f020d301efad355745"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/rabbitmq/rabbitmq-server/commit/edf1fbc7217aaf736955d2e13c9534901a2e0778"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.8"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.2"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-88vh-gx85-p36m"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-312"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2026:67552", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "rabbitmq-server4-3-main-4.3.6-1.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-09-15T00:00:00Z"}], "bugzilla": {"description": "rabbitmq-server: rabbitmq-server: Information disclosure via insecure authentication cookies", "id": "2541491", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541491"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "status": "verified"}, "cwe": "CWE-312", "details": ["RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused is_authorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding rather than encryption, an attacker with same-origin cross-site scripting, an HTTP-readable network position, or local access to the browser cookie store could recover the actual login credentials; older browsers that treated an absent SameSite attribute as None also sent the cookie cross-site. This issue is fixed in versions 4.2.8 and 4.3.2.", "A flaw was found in rabbitmq-server. This vulnerability allows information disclosure due to insecure handling of authentication cookies following a login request. The application stores base64-encoded user credentials in a cookie that lacks essential security flags, such as Secure, HttpOnly, and SameSite. An attacker able to intercept unencrypted traffic, execute scripts in the victim's session, or access local browser storage can retrieve the cookie and decode plaintext login credentials."], "name": "CVE-2026-67236", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Will not fix", "package_name": "rabbitmq-server4.2", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Not affected", "package_name": "rabbitmq-server", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Not affected", "package_name": "rabbitmq-server", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Not affected", "package_name": "rabbitmq-server", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Not affected", "package_name": "rabbitmq-server", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-09-25T15:59:10Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-67236\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-67236\nhttps://github.com/rabbitmq/rabbitmq-server/commit/df9e7f4c0afd311a672705f020d301efad355745\nhttps://github.com/rabbitmq/rabbitmq-server/commit/edf1fbc7217aaf736955d2e13c9534901a2e0778\nhttps://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.8\nhttps://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.2\nhttps://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-88vh-gx85-p36m"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.2.0,4.2.8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.3.0,4.3.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "rabbitmq-server", "source": "cna", "vendor": "rabbitmq"}, "product": "rabbitmq-server", "vendor": "rabbitmq"}], "created": "2026-09-25T19:15:11.662750+00:00", "updated": "2026-09-26T11:45:09.759348+00:00", "vendors": ["rabbitmq", "rabbitmq$PRODUCT$rabbitmq-server"]}