RHSA-2026:67552HighCVSS 8.7

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
September 15, 2026
Last Modified
October 31, 2026

🔗 CVE IDs covered (54)

CVE-2026-67412 →CVE-2026-67419 →CVE-2026-67421 →CVE-2026-66080 →CVE-2026-67241 →CVE-2026-67404 →CVE-2026-67415 →CVE-2026-67420 →CVE-2026-66072 →CVE-2026-66079 →CVE-2026-67218 →CVE-2026-67224 →CVE-2026-67226 →CVE-2026-67228 →CVE-2026-67232 →CVE-2026-67235 →CVE-2026-44839 →CVE-2026-67236 →CVE-2026-67238 →CVE-2026-67410 →CVE-2026-67411 →CVE-2026-61837 →CVE-2026-66071 →CVE-2026-66074 →CVE-2026-66076 →CVE-2026-66078 →CVE-2026-67219 →CVE-2026-67221 →CVE-2026-67225 →CVE-2026-66070 →CVE-2026-67229 →CVE-2026-67233 →CVE-2026-67237 →CVE-2026-67406 →CVE-2026-67408 →CVE-2026-66075 →CVE-2026-66077 →CVE-2026-67242 →CVE-2026-67405 →CVE-2026-67407 →CVE-2026-67413 →CVE-2026-66067 →CVE-2026-66068 →CVE-2026-66073 →CVE-2026-67222 →CVE-2026-67223 →CVE-2026-67234 →CVE-2026-67239 →CVE-2026-67409 →CVE-2026-66069 →CVE-2026-67220 →CVE-2026-67227 →CVE-2026-67230 →CVE-2026-67240 →

📋 Description

CVE-2026-44839 — rabbitmq-server: RabbitMQ: Unsanitized vhost names allow for XSS in management UI CVE-2026-61837 — rabbitmq-server: RabbitMQ: Information disclosure via improper access control in AMQP management endpoint CVE-2026-66067 — rabbitmq: RabbitMQ: Authenticated user can bypass connection limits via stream protocol CVE-2026-66068 — rabbitmq: RabbitMQ: Information disclosure of decrypted Shovel URIs in debug logs CVE-2026-66069 — rabbitmq-server: RabbitMQ: Monitoring user can reset authentication attempt counters CVE-2026-66070 — rabbitmq-server: RabbitMQ: Cross-Origin Resource Sharing (CORS) misconfiguration allows unauthorized actions CVE-2026-66071 — rabbitmq-server: rabbitmq-server: Denial of service via atom exhaustion in OAuth2 JWT scope parsing CVE-2026-66072 — rabbitmq-server: RabbitMQ: Denial of Service via atom table exhaustion in stream chunk_selector CVE-2026-66073 — rabbitmq-server: rabbitmq-server: Denial of Service via management API atom table exhaustion CVE-2026-66074 — rabbitmq: RabbitMQ: Denial of Service via management API regular expression filter CVE-2026-66075 — rabbitmq-server: RabbitMQ: Monitoring user can disrupt message flow via authorization flaw CVE-2026-66076 — rabbitmq: RabbitMQ: Information disclosure via cross-vhost authorization bypass CVE-2026-66077 — RabbitMQ: RabbitMQ: Account takeover via stored Cross-Site Scripting in TLS peer-certificate DN CVE-2026-66078 — rabbitmq-server: RabbitMQ: Protected account deletion safeguard bypass via bulk-delete API CVE-2026-66079 — rabbitmq-server: RabbitMQ: Denial of Service via AMQP 1.0 array32 parsing CVE-2026-66080 — rabbitmq-server: RabbitMQ: Denial of Service via unbounded super-stream partition allocation CVE-2026-67218 — rabbitmq-server: RabbitMQ: Privilege escalation via super-stream HTTP creation CVE-2026-67219 — rabbitmq: RabbitMQ: Denial of Service via unbounded consistent-hash exchange weight CVE-2026-67220 — rabbitmq-server: RabbitMQ: Denial of Service via JMS topic exchange atom exhaustion CVE-2026-67221 — rabbitmq: RabbitMQ: Information disclosure of AMQP 1.0 shovel URI passwords CVE-2026-67222 — rabbitmq-server: rabbitmq-server: Denial of Service via resource exhaustion in authentication mechanism handling CVE-2026-67223 — rabbitmq-server: rabbitmq-server: Unauthorized access via LDAP distinguished name injection CVE-2026-67224 — rabbitmq: RabbitMQ: Administrator path traversal allows arbitrary file write CVE-2026-67225 — rabbitmq-server: rabbitmq-server: Denial of Service via oversized stream protocol frame CVE-2026-67226 — rabbitmq-server: rabbitmq-server: Denial of Service via Erlang atom exhaustion in user tag management CVE-2026-67227 — rabbitmq-server: rabbitmq-server: Denial of Service via atom exhaustion in global parameters API CVE-2026-67228 — rabbitmq: RabbitMQ: Denial of Service via atom exhaustion in runtime-parameter component CVE-2026-67229 — RabbitMQ: RabbitMQ: Denial of Service via admin-only atom exhaustion from crafted vhost metadata CVE-2026-67230 — rabbitmq-server: rabbitmq-server: Denial of Service via unbounded pre-authentication state accumulation in Web STOMP CVE-2026-67232 — rabbitmq: rabbitmq_web_mqtt: RabbitMQ Web-MQTT plugin: Denial of Service via decompression bomb CVE-2026-67233 — rabbitmq-server: RabbitMQ: Privilege escalation allows monitoring users to delete shovels CVE-2026-67234 — rabbitmq-server: rabbitmq-server: Authentication preference persistence via invalid cookie name CVE-2026-67235 — rabbitmq-server: RabbitMQ: Denial of Service via AMQP 0-9-1 body size validation bypass CVE-2026-67236 — rabbitmq-server: rabbitmq-server: Information disclosure via insecure authentication cookies CVE-2026-67237 — rabbitmq-server: rabbitmq-server: Cross-site scripting via unescaped OAuth token injection CVE-2026-67238 — rabbitmq-server: RabbitMQ: Denial of Service due to atom-table exhaustion via reply-to queue name decoding CVE-2026-67239 — rabbitmq-server: rabbitmq-server: Stored Cross-Site Scripting via TLS peer certificate in stream-management UI CVE-2026-67240 — RabbitMQ: RabbitMQ: Denial of Service via crafted AMQP 1.0 SQL LIKE filter CVE-2026-67241 — rabbitmq-server: rabbitmq-server: Unauthorized message routing via missing alternate-exchange permission check CVE-2026-67242 — rabbitmq-server: rabbitmq-server: Authentication bypass via improper validation of floating-point token expiration timestamps CVE-2026-67404 — rabbitmq-server: rabbitmq-server: OAuth2 silent verify_none fallback for JWKS fetch CVE-2026-67405 — rabbitmq-server: RabbitMQ: Cross-Site WebSocket Hijacking via missing Origin header validation CVE-2026-67406 — rabbitmq-server: rabbitmq-server: Information disclosure via unredacted credentials in Shovel crash logs CVE-2026-67407 — rabbitmq-server: rabbitmq-server: MQTT topic permission bypass via improper regex escaping CVE-2026-67408 — rabbitmq-server: rabbitmq-server: Denial of Service via excessive memory allocation in stream management CVE-2026-67409 — rabbitmq-server: rabbitmq-server: Authentication Denial of Service via unvalidated JWKS HTTP response status codes CVE-2026-67410 — rabbitmq-server: rabbitmq-server: Sensitive credential disclosure via unauthenticated JavaScript endpoint CVE-2026-67411 — rabbitmq-server: rabbitmq-server: Access control bypass via PROXY protocol handling in MQTT CVE-2026-67412 — rabbitmq-server: RabbitMQ: Unauthorized cross-vhost message access via missing Federation upstream authorization CVE-2026-67413 — rabbitmq-server: rabbitmq-server: Denial of Service via unbounded regular expression evaluation in JMS topic exchange CVE-2026-67415 — rabbitmq-server: rabbitmq-server: Denial of Service via Shovel plugin atom exhaustion CVE-2026-67419 — rabbitmq-server: rabbitmq-server: Denial of Service via consecutive wildcards in topic binding keys CVE-2026-67420 — rabbitmq-server: rabbitmq-server: Unauthorized user impersonation via stale OAuth token refresh CVE-2026-67421 — rabbitmq-server: rabbitmq-server: Information disclosure via HTML injection in management interface

🎯 Affected products4

  • Red Hat Hardened Images
  • rabbitmq-server4.3-0:4.3.6-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • rabbitmq-server4.3-0:4.3.6-1.hum1@src as a component of Red Hat Hardened Images
  • rabbitmq-server4.3-0:4.3.6-1.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: To mitigate this issue, restrict access to the RabbitMQ management UI to trusted administrators only. Ensure that administrative interfaces are not exposed to untrusted networks. Workaround: Restrict Management API access and monitoring-tag accounts, or disable the Management plugin where it is not needed. Workaround: Replace wildcard CORS with explicit trusted origins and avoid administrator Basic credentials in browsers used for untrusted sites. Workaround: Disable the stream plugin if unused, and restrict stream access to trusted clients. Workaround: Restrict monitoring access and disable federation management where it is not needed. Workaround: Restrict untrusted network access to AMQP listeners; disable AMQP 1.0 support if unused. Workaround: Restrict management-tagged accounts and disable stream management where it is not needed. Workaround: Restrict that access or disable stream management where it is not needed. Workaround: Disable the JMS topic exchange plugin if unused and restrict binding permissions to trusted users. Workaround: The rabbitmq_web_mqtt plugin is not enabled by default. Deployments that do not require MQTT-over-WebSockets can disable the plugin (for example, with `rabbitmq-plugins disable rabbitmq_web_mqtt`) to remove the vulnerable code path. Restricting network access to the Web-MQTT listener (by default ports 15675/15676) so that only trusted clients can reach it also reduces exposure. For deployments that require the Web-MQTT plugin, mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability; such deployments should upgrade to a release that contains the upstream fix. Workaround: Disable the shovel management extension on brokers that do not need to manage shovels over HTTP. Enable rabbitmq_shovel explicitly first so it stays active if it was only pulled in as a dependency: rabbitmq-plugins enable rabbitmq_shovel rabbitmq-plugins disable rabbitmq_shovel_management This removes the /api/shovels endpoint. Accounts with the policymaker or administrator tag can still delete shovels through /api/parameters, which enforces the correct role check. If the endpoint has to stay available, remove the monitoring tag from any account that should not be able to stop message flow. Workaround: Restrict publish access to trusted clients; broker memory alarms offer only partial protection until an updated build is deployed. Workaround: Restrict AMQP access to trusted clients until an updated build is deployed. Workaround: No mitigation is required for currently shipped builds. Users of affected upstream versions should upgrade to RabbitMQ 4.2.9 or 4.3.3. Until upgrading, disable AMQP 1.0 if unused or restrict exchange configuration permissions. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Disable Web-STOMP and Web-MQTT where unnecessary, or avoid those non-default authentication options until an updated build is deployed. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Disable the rabbitmq_auth_backend_oauth2 plugin and transition to internal username/password or mutual TLS (mTLS) authentication. Alternatively, place a reverse proxy in front of the JWKS endpoint to drop or sanitize non-200 HTTP responses before they reach RabbitMQ. Workaround: Disable OAuth2 authentication for the RabbitMQ Management UI and revert to internal username/password or mTLS authentication. Alternatively, restrict network access to the management UI port (default 15672) or configure a reverse proxy to block unauthenticated requests to /js/oidc-oauth/bootstrap.js.

🔗 References (58)