The RabbitMQ CVE Register, 2026 Edition

Six advisories are rated High, thirteen Medium and two Low. The Highs cluster in the 2026 batches: topic-authorization bypass across tenants, an unauthenticated stream-listener memory-exhaustion denial of service, disclosure of OAuth client credentials through an HTTP API endpoint, a stored cross-site scripting flaw in the management UI, the management API accepting request bodies larger than its configured limit, and a direct-reply-to binding flaw allowing reply-channel injection.

Publication volume was flat at one or two a year from 2021 through 2025, then rose sharply. Thirteen of the twenty-one advisories in this register were published in 2026, all of them in May and June, and most as coordinated batches affecting four release series together. A team that patched RabbitMQ on an annual cadence was, by the end of June 2026, several security releases behind on every supported series.

Each row counts the unique advisories that required a patch release on that series. Because most 2026 advisories were backported across four release lines at once, a single CVE appears once in each series it was fixed in; that is why the rows sum to 49 while the register holds 21 advisories. The current 4.2.x series carries the highest total because it is the target of every 2026 backport. The retired 3.8.x to 3.12.x series show low counts because Broadcom stopped backporting once each reached end of life, not because those versions are more secure.

Affected and patched versions are quoted as published on rabbitmq.com/security. Where Broadcom lists an enterprise-only patched build for the commercial distribution, that is noted on the advisory itself. The patched version is the floor, not the target: apply the latest release in your series, since later releases fold in every prior fix.

Three questions rank any row for a given estate. Is the affected series still in the environment? Cross-reference the series table against the fleet inventory; anything on 3.8 through 3.12 is a retired series, and those advisories are historical only if you have already moved. Is the vulnerable surface actually exposed? Several 2026 advisories require management-UI access, a specific OAuth 2 configuration or Windows-specific UNC handling; confirm the precondition applies before treating every row as equally urgent. Is the patched version current? The patched column is the minimum, and the latest release in the series is the target.

For teams on a retired series, or on a 3.13 or 4.x build past its end of support, the choice is between an urgent version upgrade and a CVE-patched extended build that backports exactly these fixes without a full migration. Where an upgrade window is not available this quarter, the backport is usually the faster and lower-risk path. RabbitMQ CVEs: what actually needs patching works through the exposure question; extended LTS support for RabbitMQ 3.x is the contract that delivers the backports.

The register consolidates every advisory listed on rabbitmq.com/security, which mirrors the project's GitHub Security Advisories, between 27 June 2021 and 24 June 2026. Severity and version ranges are quoted as published; no severity has been re-scored. The Java client advisory is included because it appears on the same page; other client libraries are not tracked here. Commercial VMware Tanzu RabbitMQ customers should treat the Broadcom Support Portal as authoritative, since it includes advisories in dependencies and in the Erlang runtime that the public page does not list.

New advisories publish on an ongoing basis. Verify against the live security page before a compliance submission; this page is re-issued with each edition of the register.