A cross‑site scripting flaw in the rabbitmq_federation_management plugin allows an authenticated user with permission to set up federation upstreams or policies to embed arbitrary HTML‑script tags into the consumer_tag field. When the Federation Status page renders this field without escaping, the browser executes the stored script in the context of any user who subsequently views the page, enabling client‑side code execution such as session hijacking or credential theft. The weakness corresponds to Input Validation failures (CWE‑79).

RabbitMQ Server, all deployments using the rabbitmq_federation_management plugin prior to version 3.13.14, 4.0.19, 4.1.10, or 4._federation_management plugin displays the consumer_tag field on the Federation Status dashboard without escaping HTML, creating a stored cross‑site flaw. An attacker who can configure a federation upstream or policy can inject malicious JavaScript that executes in the browsers of users who later view the impacted page. Because the vulnerability allows client‑side code execution, it can be leveraged for session hijacking, credential theft, or other malicious actions in the context of a user viewing the UI, risk.

The CVSS score of 5.7 indicates a moderate impact. The EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to configure federation upstreams or policies, thus it is limited the payload, the script runs automatically when any user views the Federation Status page, making this a classic stored XSS that can affect any authenticated user who accesses the UI.