RabbitMQ up to 4.2.7/4.3.1 Login is_authorized cookie httponly flag

Summaryinfo

A vulnerability, which was classified as problematic, has been found in RabbitMQ up to 4.2.7/4.3.1. This affects the function is_authorized of the component Login. This manipulation causes cookie httponly flag. This vulnerability is handled as CVE-2026-67236. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in RabbitMQ up to 4.2.7/4.3.1 and classified as problematic. Affected by this vulnerability is the function is_authorized of the component Login. The manipulation with an unknown input leads to a cookie httponly flag vulnerability. The CWE definition for the vulnerability is CWE-1004. The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag. As an impact it is known to affect confidentiality. The summary by CVE is:

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused is_authorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding rather than encryption, an attacker with same-origin cross-site scripting, an HTTP-readable network position, or local access to the browser cookie store could recover the actual login credentials; older browsers that treated an absent SameSite attribute as None also sent the cookie cross-site. This issue is fixed in versions 4.2.8 and 4.3.2.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-67236 since 07/28/2026. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available.

Upgrading to version 4.2.8 or 4.3.2 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• RabbitMQ

Version

• 4.2.0
• 4.2.1
• 4.2.2
• 4.2.3
• 4.2.4
• 4.2.5
• 4.2.6
• 4.2.7
• 4.3.0
• 4.3.1

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion