The vulnerability exists in the RabbitMQ management plugin’s CORS handling logic. When the configuration allows any origin, the server reflects the request’s Origin header straight back as the Access‑Control‑Allow‑Origin value and also returns Access‑Control‑Allow‑Credentials: true, even though the configuration uses a wildcard. As a result, a malicious web page that a signed‑in administrator visits can trigger cross‑origin requests that the browser automatically authenticates with the administrator’s cached HTTP Basic credentials. This permits an attacker to perform unauthorized, state‑changing operations on the management API through the privileged administrator’s session. The weakness is a misuse of CORS headers and credential leakage (CWE‑942).

RabbitMQ messaging and streaming broker, specifically the rabbitmq-server product. Versions affected include any releases prior to 3.13.17, 4.0.22, 4.1.13, and 4.2.6 when the management plugin is configured with the wildcard cors_allow_origins="*". Administrators who have cached HTTP Basic authentication in the browser are able to be coerced by the vulnerability.

The CVSS score of 7.6 indicates moderate‑to‑high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user‑agent that has a cached administrator credential and a malicious page to trigger the cross‑origin request; therefore the likelihood of a widespread, automated attack is lower, but within an environment where administrators use browsers with cached credentials and the management plugin is misconfigured, the risk is significant.