An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and t

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• broadcom rabbitmq server3.4.0
• broadcom rabbitmq server3.4.1
• broadcom rabbitmq server3.4.2
• broadcom rabbitmq server3.4.3
• broadcom rabbitmq server3.4.4
• broadcom rabbitmq server3.5.0
• broadcom rabbitmq server3.5.1
• broadcom rabbitmq server3.5.2
• broadcom rabbitmq server3.5.3
• broadcom rabbitmq server3.5.6
• broadcom rabbitmq server3.6.7
• debian debian linux9.0
• pivotal software rabbitmq1.5.0
• pivotal software rabbitmq1.5.1
• pivotal software rabbitmq1.5.10
• pivotal software rabbitmq1.5.11
• pivotal software rabbitmq1.5.12
• pivotal software rabbitmq1.5.13
• pivotal software rabbitmq1.5.14
• pivotal software rabbitmq1.5.15

Versions reported by the vendor

Affected version ranges reported by the assigning authority (dell). Independent of NVD's CPE analysis and usually ahead of it.

• n/a Pivotal RabbitMQ

  • Pivotal RabbitMQaffected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-57216RabbitMQ: AMQP 1.0, AMQP 0-9-1, Stream Protocol loopback enforcement can lead to remote guest sessions due to listener-address loopback checks
  40Plan
• CVE-2026-57211RabbitMQ: UNC SSRF affecting the management UI on Windows
  40Plan
• CVE-2016-9877An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1
  39Monitor
• CVE-2026-57219RabbitMQ: Unauthenticated disclosure of OAuth client credentials via an HTTP API endpoint with certain less common OAuth 2 configurations
  35Monitor
• CVE-2021-22117RabbitMQ installers on Windows prior to version 3.8.16 do not harden plugin directory permissions, potentially allowing attackers with suffi
  31Monitor
• CVE-2019-11287RabbitMQ Web Management Plugin DoS via heap overflow
  31Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

User content is inserted into the page as HTML. The browser interprets the content as code rather than data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1commentEl.innerHTML = comment.body;

1commentEl.textContent = comment.body;

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.