CVE-2026-57213CWE-79

RabbitMQ: Stored XSS federation management plugin via unsanitized consumer_tag rendering

Medium · published July 10, 2026

CVSS v4.0
5.7
EPSS
0%
Percentile
15.7
In the wild
Unconfirmed
What it is

RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_federation_management plugin renders the consumer_tag field on the Federation Status page without HTML escaping, allowing a user who can configure a federation upstream or policy to execute JavaScript in the browser of a user viewing that page. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5.

The record
Technical detail
CVSS v4.0
5.7 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00252 · 15.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-07-10T20:14Z
EPSS history
Timeline
  • 10 JUL 20:14Z
    RabbitMQ: Stored XSS federation management plugin via unsanitized consumer_tag rendering
    cvelistv5