This vulnerability allows an attacker to insert malicious HTML or JavaScript into the stream‑management UI by forging a TLS peer certificate. The subject or issuer DN of the certificate is displayed by the UI without proper HTML encoding, enabling stored XSS. The affected weakness is a cross‑site scripting flaw (CWE‑79). If an attacker can obtain a certificate signed by a CA trusted by the stream listener, the injected payload will execute in the browser of any operator who views the stream connection details, potentially allowing session hijacking, credential theft, or further lateral movement.

The issue affects RabbitMQ Server from versions 3.13.0 through 3.13.18, and 4.0.23, 4.1.14, 4.2.9, and 4.3.3. It is fixed in those same releases. Operators using earlier versions or any configuration that employs a stream TLS listener with verifypeer enabled and uses a trusted CA are vulnerable.

The CVSS score of 7.6 indicates a high severity. No EPSS data is available, but the vulnerability is not yet listed in CISA's KEV catalog, suggesting limited public exploitation. The exploitation requires a specific configuration: a stream TLS listener with verifypeer enabled and an attacker‑controlled certificate that the listener trusts. Consequently, the attack is feasible only in environments where the operator authenticates to the stream‑management UI and the TLS setup permits an attacker to supply a trusted certificate. While the attack surface is limited, the impact on the operator’s browser can be severe, warranting prompt mitigation.