CVE-2026-66077

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which <%= ... %> does NOT HTML-escape. connection.ejs:135 renders <%= connection.ssl_details.peer_cert_subject %> (and peer_cert_issuer) directly into the page. The same pattern appears in streamConnection.ejs:102,106,110. The values come from rabbit_ssl:peer_cert_subject/1 which formats the DN as a string without HTML escaping. The verifier corrected the original researcher's claim: this is reachable only when the listener is configured with verify_peer (so the certificate must be signed by a CA in the broker's trust store, not arbitrary self-signed); however, in deployments using mTLS for client authentication, any user who can request a certificate from the organisational CA controls the Subject CN. An attacker who can obtain a TLS client certificate signed by a CA the broker trusts (with verify_peer enabled) can embed JavaScript in the certificate's Subject DN. When any administrator views that connection in the management UI, the script executes in the admin's browser session, allowing full account takeover (create users, export definitions, etc.). The management UI's CSP includes 'unsafe-inline', so inline script execution is not blocked. Preconditions include TLS listener configured with ssl_options.verify = verify_peer Attacker can obtain a CA-signed client certificate with attacker-chosen Subject (e.g. self-service corporate PKI, or rabbitmq_trust_store plugin in use) Administrator views the connection detail page. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

Overview

State: PUBLISHED
Assigner (CNA): GitHub_M
CVSS severity: HIGH
CVSS score: 7.3 / 10
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Effective score: 7.3 / 10 HIGH source: CNA overview
CWE(s): CWE-79
Reserved: 2026-07-23
Published: 2026-09-23 20:03 UTC
Last updated: 2026-09-23 20:03 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/66xxx/CVE-2026-66077.json
Linked Threat: CVE-2026-66077 — RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-09-23 21:16:59 UTC
NVD last modified: 2026-09-23 21:16:59 UTC

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-85628
Assigner: GitHub_M
Published: Sep 23, 2026, 8:03:42 PM
Updated: Sep 23, 2026, 8:03:42 PM
EUVD base score (CVSS 4.0): 7.3 / 10
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
EUVD-reported EPSS: 0.0000
Vendors: rabbitmq
Products: rabbitmq-server (4.2.0, < 4.2.6)

rabbitmq-server (4.1.0, < 4.1.11)

rabbitmq-server (3.13.0, < 3.13.15)

rabbitmq-server (4.0.0, < 4.0.20)

ENISA description: RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which <%= ... %> does NOT HTML-escape. connection.ejs:135 renders <%= connection.ssl_details.peer_cert_subject %> (and peer_cert_issuer) directly into the page. The same pattern appears in streamConnection.ejs:102,106,110. The values come from rabbit_ssl:peer_cert_subject/1 which formats the DN as a string without HTML escaping. The verifier corrected the original researcher's claim: this is reachable only when the listener is configured with verify_peer (so the certificate must be signed by a CA in the broker's trust store, not arbitrary self-signed); however, in deployments using mTLS for client authentication, any user who can request a certificate from the organisational CA controls the Subject CN. An attacker who can obtain a TLS client certificate signed by a CA the broker trusts (with verify_peer enabled) can embed JavaScript in the certificate's Subject DN. When any administrator views that connection in the management UI, the script executes in the admin's browser session, allowing full account takeover (create users, export definitions, etc.). The management UI's CSP includes 'unsafe-inline', so inline script execution is not blocked. Preconditions include TLS listener configured with ssl_options.verify = verify_peer Attacker can obtain a CA-signed client certificate with attacker-chosen Subject (e.g. self-service corporate PKI, or rabbitmq_trust_store plugin in use) Administrator views the connection detail page. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

EUVD references (2)

Affected products (1)

Vendor	Product	Versions	Platforms
rabbitmq	rabbitmq-server	`>= 3.13.0, < 3.13.15` (affected), `>= 4.0.0, < 4.0.20` (affected), `>= 4.1.0, < 4.1.11` (affected), `>= 4.2.0, < 4.2.6` (affected)	—

Vendor references (2)

References embedded in the original CVE record by the assigning CNA.

https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-rjcf-35r5-xw38 x_refsource_CONFIRM
https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6 x_refsource_MISC

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (2)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6 security-advisories@github.com
https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-rjcf-35r5-xw38 security-advisories@github.com

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

CVE-2026-63077 - Vulnerability Details - OpenCVE

web:app.opencve.io

Remediation No vendor fix or workaround currently provided. OpenCVE Recommended Actions Upgrade JetBrains TeamCity to version 2026.1.3 or later, or 2025.11.7 or newer. Disable external agent connections on the TeamCity server or configure the server to accept agent connections only from trusted IP addresses.

2026-09-24 11:13 UTC
CVE-2026-63077: Additional Guidance Following Reports of Active ...

web:blog.jetbrains.com

CVE - 2026 -63077 has been fixed in TeamCity 2025.11.7 and 2026.1.3. Customers should update to one of these versions as soon as possible. If you are unable to update immediately, a security patch plugin is available for TeamCity 2017.1 and later. For complete update and mitigation instructions, including information about installing the security patch plugin, please refer to our original ...

2026-09-24 11:13 UTC
CVE-2026-63077: JetBrains TeamCity Unauthenticated RCE

web:denizhalil.com

Technical analysis of CVE - 2026 -63077, an unauthenticated Remote Code Execution (RCE) vulnerability in JetBrains TeamCity. Learn the root cause, exploitation vector, and remediation steps.

2026-09-24 11:13 UTC
Nvd-cve-2026-63077

web:nvd.nist.gov

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

2026-09-24 11:13 UTC
JetBrains Patches CVSS 9.8 TeamCity Flaw Allowing Server Takeover

web:securityaffairs.com

JetBrains patched a critical TeamCity flaw ( CVE - 2026 -63077) enabling unauthenticated code execution on affected on-premise servers.

2026-09-24 11:13 UTC
Microsoft Patch Tracker (September 2026): Exploit-Ranked | Senserva

web:senserva.com

Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.

2026-09-24 11:13 UTC
CVE-2026-63077: Update TeamCity After CISA Confirms Active RCE

web:windowsforum.com

CISA has added CVE - 2026 -63077, an unauthenticated remote-code-execution flaw in JetBrains TeamCity On-Premises, to its Known Exploited Vulnerabilities catalog after determining that the vulnerability is being actively exploited.

2026-09-24 11:13 UTC
Rapid7 Analysis of CVE-2026-63077, an unauthenticated Remote Code ...

web:www.rapid7.com

A technical analysis of CVE - 2026 -63077. This is an unauthenticated Remote Code Execution vulnerability in JetBrains TeamCity due to unsafe deserialization in the agent polling protocol endpoint.

2026-09-24 11:13 UTC
Critical CVE-2026-63077: Unauthenticated Remote Code Execution ...

web:www.rescana.com

TeamCity Cloud is not affected. JetBrains has also released a security patch plugin for versions 2017.1 and newer, allowing organizations unable to upgrade immediately to mitigate the vulnerability. Workaround and Mitigation The primary remediation is to upgrade TeamCity On-Premises to version 2025.11.7 or 2026.1.3 as soon as possible.

2026-09-24 11:13 UTC
CVE-2026-63077 Impact, Exploitability, and Mitigation Steps | Wiz

web:www.wiz.io

Understand the critical aspects of CVE - 2026 -63077 with a detailed vulnerability assessment, exploitation potential, affected technologies, and remediation guidance.

2026-09-24 11:13 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-66077.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "rabbitmq-server",
          "vendor": "rabbitmq",
          "versions": [
            {
              "status": "affected",
              "version": ">= 3.13.0, < 3.13.15"
            },
            {
              "status": "affected",
              "version": ">= 4.0.0, < 4.0.20"
            },
            {
              "status": "affected",
              "version": ">= 4.1.0, < 4.1.11"
            },
            {
              "status": "affected",
              "version": ">= 4.2.0, < 4.2.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which <%= ... %> does NOT HTML-escape. connection.ejs:135 renders <%= connection.ssl_details.peer_cert_subject %> (and peer_cert_issuer) directly into the page. The same pattern appears in streamConnection.ejs:102,106,110. The values come from rabbit_ssl:peer_cert_subject/1 which formats the DN as a string without HTML escaping. The verifier corrected the original researcher's claim: this is reachable only when the listener is configured with verify_peer (so the certificate must be signed by a CA in the broker's trust store, not arbitrary self-signed); however, in deployments using mTLS for client authentication, any user who can request a certificate from the organisational CA controls the Subject CN. An attacker who can obtain a TLS client certificate signed by a CA the broker trusts (with verify_peer enabled) can embed JavaScript in the certificate's Subject DN. When any administrator views that connection in the management UI, the script executes in the admin's browser session, allowing full account takeover (create users, export definitions, etc.). The management UI's CSP includes 'unsafe-inline', so inline script execution is not blocked. Preconditions include TLS listener configured with ssl_options.verify = verify_peer Attacker can obtain a CA-signed client certificate with attacker-chosen Subject (e.g. self-service corporate PKI, or rabbitmq_trust_store plugin in use) Administrator views the connection detail page. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T20:03:42.797Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-rjcf-35r5-xw38",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-rjcf-35r5-xw38"
        },
        {
          "name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
        }
      ],
      "source": {
        "advisory": "GHSA-rjcf-35r5-xw38",
        "discovery": "UNKNOWN"
      },
      "title": "RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-66077",
    "datePublished": "2026-09-23T20:03:42.797Z",
    "dateReserved": "2026-07-23T23:25:28.898Z",
    "dateUpdated": "2026-09-23T20:03:42.797Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}