https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 05:17:58 +0000 https://vulnerability.circl.lu/vuln/cve-2026-66077 <p><strong>Affected:</strong> rabbitmq-server</p> <p>RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which &lt;%= ... %&gt; does NOT HTML-escape. connection.ejs:135 renders &lt;%= connection.ssl_details.peer_cert_subject %&gt; (and peer_cert_issuer) directly into the page. The same pattern appears in streamConnection.ejs:102,106,110. The values come from rabbit_ssl:peer_cert_subject/1 which formats the DN as a string without HTML escaping. The verifier corrected the original researcher&#39;s claim: this is reachable only when the listener is configured with verify_peer (so the certificate must be signed by a CA in the broker&#39;s trust store, not arbitrary self-signed); however, in deployments using mTLS for client authentication, any user who can request a certificate from the organisational CA controls the Subject CN. An attacker who can obtain a TLS client certificate signed by a CA the broker trusts (with verify_peer enabled) can embed JavaScript in the certificate&#39;s Subject DN. When any administrator views that connection in the management UI, the script executes in the admin&#39;s browser session, allowing full account takeover (create users, export definitions, etc.). The management UI&#39;s CSP includes &#39;unsafe-inline&#39;, so inline script execution is not blocked. Preconditions include TLS listener configured with ssl_options.verify = verify_peer Attacker can obtain a CA-signed client certificate with attacker-chosen Subject (e.g. self-service corporate PKI, or r…</p> <p><strong>Affected:</strong> rabbitmq-server</p> <p>RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which &lt;%= ... %&gt; does NOT HTML-escape. connection.ejs:135 renders &lt;%= connection.ssl_details.peer_cert_subject %&gt; (and peer_cert_issuer) directly into the page. The same pattern appears in streamConnection.ejs:102,106,110. The values come from rabbit_ssl:peer_cert_subject/1 which formats the DN as a string without HTML escaping. The verifier corrected the original researcher&#39;s claim: this is reachable only when the listener is configured with verify_peer (so the certificate must be signed by a CA in the broker&#39;s trust store, not arbitrary self-signed); however, in deployments using mTLS for client authentication, any user who can request a certificate from the organisational CA controls the Subject CN. An attacker who can obtain a TLS client certificate signed by a CA the broker trusts (with verify_peer enabled) can embed JavaScript in the certificate&#39;s Subject DN. When any administrator views that connection in the management UI, the script executes in the admin&#39;s browser session, allowing full account takeover (create users, export definitions, etc.). The management UI&#39;s CSP includes &#39;unsafe-inline&#39;, so inline script execution is not blocked. Preconditions include TLS listener configured with ssl_options.verify = verify_peer Attacker can obtain a CA-signed client certificate with attacker-chosen Subject (e.g. self-service corporate PKI, or r…</p> https://vulnerability.circl.lu/vuln/cve-2026-66077