Red Hat Security Advisory

RHSA-2026:35940

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-07-06 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images rabbitmq-server4-2-main@aarch64, rabbitmq-server4-2-main@src, rabbitmq-server4-2-main@x86_64

Fixes 11 records

TI-2026-41154 CVE-2026-57216

Improper authentication in rabbitmq-server

HIGH 76

RabbitMQ is a messaging and streaming broker.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00504 Published 2026-07-10 Fixed in 4.2.6, 4.1.11 +2 CWE-287

TI-2026-41149 CVE-2026-57211

RabbitMQ: UNC SSRF affecting the management UI on Windows

HIGH 76

RabbitMQ is a messaging and streaming broker.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00631 Published 2026-07-10 Fixed in 4.2.6, 4.1.11 CWE-36

TI-2026-41158 CVE-2026-57220

Resource allocation without limits in rabbitmq-server

HIGH 72

RabbitMQ is a messaging and streaming broker.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00547 Published 2026-07-10 Fixed in 4.2.6 CWE-770

TI-2026-41155 CVE-2026-57217

RabbitMQ: Topic authorization can lead to cross-tenant routing-key bypass

MEDIUM 64

RabbitMQ is a messaging and streaming broker.

CVSS 4.0HIGH 7.0 Network Low privileges No interaction EPSS 0.00352 Published 2026-07-10 Fixed in 4.2.6, 4.1.11 +2 CWE-863

TI-2026-41152 CVE-2026-57214

RabbitMQ: Stored XSS in RabbitMQ management UI

MEDIUM 64

RabbitMQ is a messaging and streaming broker.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.0022 Published 2026-07-10 Fixed in 4.2.5 CWE-79

TI-2026-41150 CVE-2026-57212

RabbitMQ management HTTP API accepts request bodies larger than configured max_http_body_size

MEDIUM 64

RabbitMQ is a messaging and streaming broker.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00433 Published 2026-07-10 Fixed in 4.2.5, 4.1.10 +2 CWE-770

TI-2026-41151 CVE-2026-57213

RabbitMQ: Stored XSS federation management plugin via unsanitized consumer_tag rendering

MEDIUM 59

RabbitMQ is a messaging and streaming broker.

CVSS 4.0MEDIUM 5.7 Network High privileges User interaction EPSS 0.00252 Published 2026-07-10 Fixed in 4.2.5, 4.1.10 +2 CWE-79

TI-2026-41156 CVE-2026-57218

RabbitMQ: AMQP 0-9-1 in combination with OAuth 2: consumer persistence can lead to post-revocation message disclosure

MEDIUM 56

RabbitMQ is a messaging and streaming broker.

CVSS 4.0MEDIUM 4.9 Network Low privileges No interaction EPSS 0.00352 Published 2026-07-10 Fixed in 4.2.6 CWE-863

TI-2026-41157 CVE-2026-57219

Information disclosure in rabbitmq-server

MEDIUM 45

RabbitMQ is a messaging and streaming broker.

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.02837 Published 2026-07-10 Fixed in 4.2.6, 4.1.11 +2 CWE-200

TI-2026-41153 CVE-2026-57215

RabbitMQ: Direct-reply-to binding persistence can lead to unauthorized reply-channel injection and persistent phantom

LOW 31

RabbitMQ is a messaging and streaming broker.

CVSS 4.0HIGH 7.0 Network Low privileges No interaction EPSS 0.00382 Published 2026-07-10 Fixed in 4.2.6, 4.1.11 +2 CWE-863

TI-2026-41159 CVE-2026-57221

RabbitMQ: Passive queue/exchange declaration bypasses authorization checks, leaking queue metadata to unprivileged users

LOW 24

RabbitMQ is a messaging and streaming broker.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0041 Published 2026-07-10 Fixed in 4.2.6, 4.1.11 +2 CWE-862