# CVE-2026-67236

RabbitMQ auth cookie leaks base64 creds on POST /login (fixed in 4.2.8/4.3.2)

- Page: https://www.vulneraibility.com/cve/CVE-2026-67236
- CVSS: 8.2
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.17% (percentile 5.9)
- CISA SSVC: exploitation none, automatable no, technical impact partial (assessed 2026-09-28)
- Weakness: CWE-312
- Also known as: GHSA-88vh-gx85-p36m
- Published: 2026-09-25

## Affected versions

- rabbitmq: affected >= 4.2.0 and < 4.2.8; >= 4.3.0 and < 4.3.2; fixed in 4.2.8, 4.3.2 (Bitnami advisory, via OSV)
- rabbitmq rabbitmq-server: affected >= 4.2.0 and < 4.2.8; >= 4.3.0 and < 4.3.2

A version outside these ranges is not a statement that it is unaffected.

## Impact

Attackers can extract plaintext user:pass from auth cookie via XSS, network sniffing, or local cookie access, enabling account compromise and lateral movement.

## Action

Patch when possible

## Recommendation

Upgrade to 4.2.8 or 4.3.2; rotate credentials and invalidate session cookies.

## References

- [other] https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-88vh-gx85-p36m
- [other] https://github.com/rabbitmq/rabbitmq-server/commit/df9e7f4c0afd311a672705f020d301efad355745
- [other] https://github.com/rabbitmq/rabbitmq-server/commit/edf1fbc7217aaf736955d2e13c9534901a2e0778
- [other] https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.8
- [other] https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.2

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.