USN-8933-1: RabbitMQ Server vulnerabilities fixed in Ubuntu update

Advisory USN-8933-1, published on 15 October 2026, groups several vulnerabilities in RabbitMQ Server fixed in an Ubuntu update. This text is an automatic translation of the Ubuntu Security feed, and the original advisory should be consulted for the full list of affected releases. Problems cited include a wildcard CORS origin configuration that could allow cross-site request forgery (CVE-2026-66070); incorrect handling of TLS peer certificate distinguished names in the management interface, with cross-site scripting risk (CVE-2026-66077); AMQP 1.0 arrays with zero-width element constructors, with denial of service risk (CVE-2026-66079); and a trust-store plugin that incorrectly validated client certificates, potentially bypassing TLS client authentication (CVE-2026-67231). Also described are issues with WebSocket frame sizes and content header body sizes (CVE-2026-67232 and CVE-2026-67235), credentials stored in an insecure cookie (CVE-2026-67236), OAuth bearer tokens exposed in boot JavaScript (CVE-2026-67237), PID node names encoded in ETF (CVE-2026-67238), TLS peer certificate names in the streams interface (CVE-2026-67239), and OAuth2 SSL options when no CA certificates are available. The available excerpt is truncated, so the full list should be checked at the source.