{"schemaVersion":3,"id":"SUSE-SU-2026:23859-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for rabbitmq-server\n\nThis update for rabbitmq-server fixes the following issues:\n\n- CVE-2026-44839: XSS in management UI due to unsanitized vhost names (bsc#1266465).\n- CVE-2026-57212: The rabbitmq_management HTTP API accepts oversized valid JSON bodies on with_decode and direct_request\n  paths (bsc#1271318).\n- CVE-2026-57213: stored XSS in RabbitMQ federation management plugin via unsanitized consumer_tag rendering\n  (bsc#1271336).\n- CVE-2026-57214: stored XSS in RabbitMQ management UI (bsc#1271337).\n- CVE-2026-57215: direct-reply-to binding persistence can lead to unauthorized reply-channel injection and persistent\n  phantom (bsc#1271338).\n- CVE-2026-57216: stream Protocol loopback enforcement can lead to remote guest sessions due to listener-address\n  loopback checks (bsc#1271339).\n- CVE-2026-57217: topic authorization can lead to cross-tenant routing-key bypass (bsc#1271340).\n- CVE-2026-57218: consumer persistence can lead to post-revocation message disclosure in OAuth2 (bsc#1271343).\n- CVE-2026-57219: Unauthenticated disclosure of OAuth client credentials via an HTTP API endpoint with certain less\n  common OAuth 2 configurations (bsc#1271344).\n- CVE-2026-57220: stream listener does not enforce configured frame-size limit during authentication, permitting\n  unauth'd mem-exhaust DoS (bsc#1271345).\n- CVE-2026-57221: passive queue/exchange declaration bypasses authorization checks, leaking queue metadata to\n  unprivileged users (bsc#1271346).","dates":{"published":"2026-09-22T02:23:51.000Z","modified":"2026-09-27T18:23:16.291Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"rabbitmq-server&distro=SUSE Linux Enterprise Server 16.0","name":"rabbitmq-server","label":"rabbitmq-server&distro=SUSE Linux Enterprise Server 16.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/rabbitmq-server&distro=SUSE Linux Enterprise Server 16.0","purlType":"rpm","versions":[{"text":"< 4.1.5-160000.2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.1.5-160000.2.1","eol":null,"hubHref":null},{"vendor":"suse","product":"rabbitmq-server&distro=SUSE Linux Enterprise Server for SAP applications 16.0","name":"rabbitmq-server","label":"rabbitmq-server&distro=SUSE Linux Enterprise Server for SAP applications 16.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/rabbitmq-server&distro=SUSE Linux Enterprise Server for SAP applications 16.0","purlType":"rpm","versions":[{"text":"< 4.1.5-160000.2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.1.5-160000.2.1","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623859-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-202623859-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1266465","label":"bugzilla.suse.com/1266465","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271318","label":"bugzilla.suse.com/1271318","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271336","label":"bugzilla.suse.com/1271336","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271337","label":"bugzilla.suse.com/1271337","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271338","label":"bugzilla.suse.com/1271338","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271339","label":"bugzilla.suse.com/1271339","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271340","label":"bugzilla.suse.com/1271340","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271343","label":"bugzilla.suse.com/1271343","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271344","label":"bugzilla.suse.com/1271344","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271345","label":"bugzilla.suse.com/1271345","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271346","label":"bugzilla.suse.com/1271346","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1279938","label":"bugzilla.suse.com/1279938","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44839","label":"www.suse.com/security/cve/CVE-2026-44839","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57212","label":"www.suse.com/security/cve/CVE-2026-57212","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57213","label":"www.suse.com/security/cve/CVE-2026-57213","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57214","label":"www.suse.com/security/cve/CVE-2026-57214","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57215","label":"www.suse.com/security/cve/CVE-2026-57215","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57216","label":"www.suse.com/security/cve/CVE-2026-57216","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57217","label":"www.suse.com/security/cve/CVE-2026-57217","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57218","label":"www.suse.com/security/cve/CVE-2026-57218","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57219","label":"www.suse.com/security/cve/CVE-2026-57219","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57220","label":"www.suse.com/security/cve/CVE-2026-57220","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57221","label":"www.suse.com/security/cve/CVE-2026-57221","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2026-44839","CVE-2026-57212","CVE-2026-57213","CVE-2026-57214","CVE-2026-57215","CVE-2026-57216","CVE-2026-57217","CVE-2026-57218","CVE-2026-57219","CVE-2026-57220","CVE-2026-57221"],"downstream":[],"duplicates":[],"related":["CVE-2026-44839","CVE-2026-57212","CVE-2026-57213","CVE-2026-57214","CVE-2026-57215","CVE-2026-57216","CVE-2026-57217","CVE-2026-57218","CVE-2026-57219","CVE-2026-57220","CVE-2026-57221"]},"timeline":[{"kind":"published","date":"2026-09-22T02:23:51.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-27T18:23:16.291Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T15:07:40.741Z","stale":false,"partial":false}}