Description
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, get_auth_mechanism/1 used term_to_binary/1 on the strict_auth_mechanism or preferred_auth_mechanism atom when clearing the corresponding cookie, producing a non-ASCII cookie name that violates RFC 6265 and can prevent the browser from deleting the preference. The issue is not directly exploitable for code execution or data exfiltration; its security relevance is limited to stale authentication-mechanism preferences persisting across logout and login cycles. This issue is fixed in versions 4.2.8 and 4.3.2.
Published: 2026-09-25
Score: 2.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: Persistence of stale authentication‑mechanism preferences
Action: Apply Patch
AI Analysis

Impact

A bug in RabbitMQ Server versions 4.2.0 through 4.2.8 and 4.3.2 causes the service to generate a cookie name containing non‑ASCII characters when clearing the authentication‑mechanism preference. This non‑RFC‑conformant cookie name can prevent a browser from deleting the cookie, leaving the preference in place across logout and subsequent login cycles. The flaw does not allow code execution or data exfiltration; its security relevance is limited to the persistence of stale authentication settings.

Affected Systems

The vulnerability affects RabbitMQ Server from version 4.2.0 up to 4.2.8 and again in 4.3.2. The affected product is the RabbitMQ message broker provided by the rabbitmq organization.

Risk and Exploitability

The CVSS score of 2.3 reflects a low severity impact. The EPSS score is not available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, the attack vector is limited to a scenario where a user authenticates via a browser that interprets cookie names; exploitation would simply result in the cookie not being deleted, allowing a stale preference to remain. Because the issue does not compromise confidentiality, integrity, or availability of data or services, the overall risk to an organization is low.

Generated by OpenCVE AI on September 25, 2026 at 18:42 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade RabbitMQ Server to version 4.2.8 or later, including 4.3.2 and subsequent releases where the issue is fixed.
  • If an upgrade cannot be applied immediately, instruct users to clear authentication‑mechanism-related cookies manually or reset browser state after logout to remove stale preferences.
  • Validate that authentication‑mechanism identifiers used by clients and servers are pure ASCII strings to avoid generating non‑conformant cookie names in future deployments.

Generated by OpenCVE AI on September 25, 2026 at 18:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 26 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Rabbitmq
Rabbitmq rabbitmq-server
Vendors & Products Rabbitmq
Rabbitmq rabbitmq-server

Fri, 25 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 25 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, get_auth_mechanism/1 used term_to_binary/1 on the strict_auth_mechanism or preferred_auth_mechanism atom when clearing the corresponding cookie, producing a non-ASCII cookie name that violates RFC 6265 and can prevent the browser from deleting the preference. The issue is not directly exploitable for code execution or data exfiltration; its security relevance is limited to stale authentication-mechanism preferences persisting across logout and login cycles. This issue is fixed in versions 4.2.8 and 4.3.2.
Title RabbitMQ: Non-RFC-conformant cookie name when clearing the auth-mechanism preference
Weaknesses CWE-20
References
Metrics cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Rabbitmq Rabbitmq-server
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-25T19:53:58.560Z

Reserved: 2026-07-28T19:50:39.438Z

Link: CVE-2026-67234

cve-icon Vulnrichment

Updated: 2026-09-25T19:53:55.201Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-25T17:17:11.743

Modified: 2026-09-28T14:38:38.163

Link: CVE-2026-67234

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T11:30:09Z

Weaknesses
  • CWE-20

    Improper Input Validation