LiveActive security incident?Get immediate response
CVE Record

CVE-2018-1279: RabbitMQ cluster compromise due to deterministically generated cookie

Pivotal RabbitMQ for PCF, all versions, uses a deterministically generated cookie that is shared between all machines when configured in a multi-tenant cluster. A remote attacker who can gain information about the network topology can guess this cookie and, if they have access to the right ports on any server in the MQ cluster can use this cookie to gain full control over the entire cluster.

HighCVSS 8.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2018-1279 affects Pivotal RabbitMQ for PCF multi-tenant clusters where a shared cluster cookie is generated predictably. If an attacker learns enough network topology and can reach the relevant cluster ports, they may guess the cookie and take full control of the RabbitMQ cluster.

Executive priority

Treat this as high priority for any RabbitMQ for PCF multi-tenant cluster. The business risk is full messaging-cluster compromise, which can expose data, disrupt applications, and undermine trust between tenants. Priority drops for environments without the affected product or without reachable cluster ports.

Technical view

The CVE describes deterministic generation of the Erlang/RabbitMQ cookie shared across machines in a multi-tenant cluster. With low privileges, network access to the correct ports, and topology knowledge, an attacker could authenticate to cluster communication and compromise confidentiality, integrity, and availability across the cluster.

Likely exposure

Exposure is most likely in Pivotal RabbitMQ for PCF deployments configured as multi-tenant clusters, especially where cluster communication ports are reachable from untrusted tenant, application, or management networks.

Exploitation context

The source bundle does not show CISA KEV listing or cited evidence of active exploitation. Exploitation is not described as trivial: the CVSS vector includes high attack complexity and low privileges, plus topology knowledge and access to the right ports.

Researcher notes

Affected metadata names Pivotal RabbitMQ for PCF version 1, while the CVE description says all versions. Scope is changed, with high confidentiality, integrity, and availability impact. Patch and mitigation details are not present in the supplied bundle, so vendor advisory review is required.

Mitigation direction

  • Review the Pivotal advisory for the supported fix or upgrade path.
  • Inventory RabbitMQ for PCF multi-tenant clusters and their versions.
  • Restrict access to RabbitMQ cluster communication ports to trusted nodes only.
  • Check vendor guidance before rotating or changing cluster cookies.
  • Prioritize remediation where tenant networks can reach cluster ports.

Validation and detection

  • Identify PCF foundations running RabbitMQ for PCF.
  • Confirm whether deployments use multi-tenant RabbitMQ clusters.
  • Review network paths to RabbitMQ cluster communication ports.
  • Verify whether vendor-recommended updates or configuration changes are applied.
  • Check logs for unexpected cluster authentication or node-join activity.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2018-1279 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.5 (3.0)
Known Exploited
No
Published

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.5CVSS 3.0HighCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H1.86Primary CVE score

Vulnerability scoring details

Base CVSS 3.0 score

8.5High
CVSS 3.0 vector shape for CVE-2018-1279Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
PivotalRabbitMq for PCF1Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.