CVE Tools
Track your stack

Rabbitmq Server

80 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Rabbitmq Server, a product in the cloud saas space. Use it to gauge the current risk picture and drill into individual advisories.

Rabbitmq Server CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Rabbitmq Server CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-061
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-020
2026-030
2026-040
2026-052
2026-060
2026-0711
2026-080
2026-0954
2026-100
2026-110

Severity

How the 80 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical34%
  • High2126%
  • Medium5670%

Latest CVEs

The 15 most recently published vulnerabilities affecting Rabbitmq Server.

  1. CVE-2026-67420RabbitMQ OAuth credential refresh retains revoked runtime tags6.5
  2. CVE-2026-67419RabbitMQ: Consecutive topic wildcards cause combinatorial routing work6.5
  3. CVE-2026-67421RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling6.8
  4. CVE-2026-67408RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service6.5
  5. CVE-2026-67406RabbitMQ: Federation and Shovel Gen-Servers Lack format_status Callback — Plaintext Credentials Exposed in Crash Dumps and sys:get_status6.5
  6. CVE-2026-67410RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint7.1
  7. CVE-2026-67227RabbitMQ: Atom exhaustion: to_atom on global-parameter :name4.9
  8. CVE-2026-67407RabbitMQ: Incomplete fix for CVE-2026-44838: `escape_regex_char/1` does not escape `-`, leaving room for an MQTT topic permission bypass7.1
  9. CVE-2026-67226RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list4.9
  10. CVE-2026-67411RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass7.1
  11. CVE-2026-67413RabbitMQ: Authenticated RabbitMQ JMS Topic Selector Users Can Consume Broker CPU with an Unbounded LIKE Regular Expression6.5
  12. CVE-2026-61837RabbitMQ: AMQP 1.0 management `GET /bindings` exposes full binding topology to any authenticated AMQP user without resource/management permission checks5.3
  13. CVE-2026-67415RabbitMQ: Shovel Management Atom Exhaustion Allows Persistent Broker-Wide Denial of Service4.9
  14. CVE-2026-67412RabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message access7.1
  15. CVE-2026-67409RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS6.5

Product grouping is registry-driven, with AI assist and human review. How it works