Ubuntu USN-8933-1 patches 12 RabbitMQ Server flaws, from TLS client-auth bypass to XSS

Serguey Asael Shinder16 October 2026, 14:022 min read

Canonical published Ubuntu Security Notice USN-8933-1 on 15 October 2026, fixing 12 vulnerabilities in RabbitMQ Server, the AMQP message broker written in Erlang. The notice covers Ubuntu 26.04, 24.04, 22.04, 20.04, 18.04 and 16.04 LTS; many of the issues affect only some of these releases.

Authentication and TLS. Two flaws weaken certificate checks. The trust-store plugin incorrectly validated client certificates, which an attacker could use to bypass TLS client authentication (CVE-2026-67231, 18.04 to 26.04). On 26.04 only, RabbitMQ mishandled the OAuth2 SSL options when no CA certificates were available, which could allow TLS verification to be bypassed (CVE-2026-67404). A third issue concerns credentials: RabbitMQ stored them in an insecure cookie, which could expose sensitive information (CVE-2026-67236, 20.04 to 26.04).

The management interface. Four issues are web flaws. TLS peer-certificate DNs were mishandled in the management UI (CVE-2026-66077, all listed releases) and in the stream management UI (CVE-2026-67239, 22.04 to 26.04), and OAuth bearer tokens were mishandled in bootstrap JavaScript (CVE-2026-67237, 24.04 and 26.04); Canonical says each could be used for a cross-site scripting attack. A wildcard CORS origin configuration was handled incorrectly, which could allow cross-site request forgery (CVE-2026-66070, 18.04 to 26.04).

Denial of service. Five flaws could be used to cause a denial of service, according to the notice: AMQP 1.0 arrays with zero-width element constructors (CVE-2026-66079), WebSocket frame sizes (CVE-2026-67232), content-header body sizes (CVE-2026-67235, all listed releases), ETF-encoded PID node names (CVE-2026-67238) and HTTP response status codes when fetching JWKS keys (CVE-2026-67409).

What to install. Canonical says a standard system update applies the fixes, followed by a restart of rabbitmq-server. The fixed versions are 4.0.5-10ubuntu5.2 on 26.04 LTS, 3.12.1-1ubuntu1.7 on 24.04 LTS and 3.9.27-0ubuntu0.6 on 22.04 LTS. For 20.04 (3.8.3-0ubuntu0.3+esm2) and 18.04 (3.6.10-1ubuntu0.5+esm1) the fixes are available through Ubuntu Pro, and for 16.04 (3.5.7-1ubuntu0.16.04.4+esm3) through Ubuntu Pro with the Legacy Support add-on.

Source: Ubuntu, "USN-8933-1: RabbitMQ Server vulnerabilities" — https://ubuntu.com/security/notices/USN-8933-1