Skip to main content

RabbitMQ CVE-2026-67404

| EUVDEUVD-2026-85631 CRITICAL
Improper Certificate Validation (CWE-295)
2026-09-23 GitHub_M
Information Disclosure Rabbitmq Server Suse Erlang Rabbitmq
9.2
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
9.2 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.1 HIGH

AC:H because success requires a man-in-the-middle position plus the missing-CA misconfiguration; PR:N since no broker credentials are needed; forged-JWT auth bypass yields full C/I/A on the broker (S:U).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

5
POC Analysis Generated
Sep 23, 2026 - 23:22 vuln.today
Metadata Corrected
Sep 23, 2026 - 21:40 vuln.today
tag: Erlang added
Patch available
Sep 23, 2026 - 21:17 EUVD
Analysis Generated
Sep 23, 2026 - 20:47 vuln.today
CVE Published
Sep 23, 2026 - 20:08 cve.org
CRITICAL 9.2

DescriptionCVE.org

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, When no CA bundle is available, ssl_options/1 falls back to [{verify, verify_none}] with no warning. An attacker in a man-in-the-middle position can forge the JWKS response, which leads the broker to accept arbitrary JWTs. Preconditions include The OAuth2 plugin must be in use with no cacertfile configured and the OS CA bundle empty or unreadable (for example, in a minimal container), and the attacker must hold a network man-in-the-middle position.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

AnalysisAI

RabbitMQ brokers that use the OAuth2 plugin can silently fall back to disabled TLS certificate verification when no CA bundle can be located, allowing an attacker already positioned as a network man-in-the-middle to forge the JWKS response and inject arbitrary JWTs that the broker will accept as authentic. The flaw affects RabbitMQ server versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, and exploitation requires four conditions to align: the OAuth2 plugin must be in use, no cacertfile may be configured, the host or container's OS CA bundle must be empty or unreadable, and the attacker must hold a MitM position on the path to the identity provider's JWKS endpoint. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a specific stack of conditions, all named in the advisory: (1) the RabbitMQ OAuth2 plugin must be enabled and in use; (2) no cacertfile is configured for the broker's TLS/JWKS validation; (3) the operating system CA bundle must be empty or unreadable - explicitly the case in minimal container images; and (4) the attacker must already hold a network man-in-the-middle position to intercept and forge the JWKS response. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine but heavily precondition-gated authentication-bypass flaw, not a blanket internet-exploitable critical. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade to a fixed release: RabbitMQ 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.0, and follow the vendor advisory at https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-37wx-r6q9-6fhj for the branch that matches your deployment; verify Erlang/OTP compatibility before upgrading, since nodes on older Erlang releases will fail to start. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory every RabbitMQ broker (server versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 are in scope) and determine which instances enable the OAuth2 plugin; for any broker where OAuth2 is not required, disable the plugin immediately, and for those where it is required, explicitly configure cacertfile to a trusted, readable CA bundle and verify the host or container OS trust store is populated and readable rather than empty. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Rabbitmq Server

View all
CVE-2026-57219 HIGH POC
8.7 Jul 10

Sensitive credential disclosure in RabbitMQ affects installations running the management plugin with OAuth 2 configured

CVE-2019-11287 HIGH POC
7.5 Nov 23

Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x ver
CVE-2016-9877 CRITICAL
9.8 Dec 29

An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.
CVE-2025-50200 MEDIUM POC
5.5 Jun 19

RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in
CVE-2026-67231 CRITICAL
9.1 Sep 23

TLS client-authentication bypass in the RabbitMQ trust-store plugin lets a remote unauthenticated attacker whose forged

CVE-2026-67409 HIGH
8.2 Sep 25

Authentication denial of service in RabbitMQ affects deployments running the rabbitmq_auth_backend_oauth2 plugin from 3.
CVE-2026-67410 HIGH
8.2 Sep 25

OAuth2 client secret disclosure in the RabbitMQ Management UI affects versions 4.2.0 through 4.2.8 and 4.3.0 through 4.3
CVE-2026-67232 HIGH
8.2 Sep 23

Memory-exhaustion denial of service in RabbitMQ's Web-MQTT plugin (rabbitmq_web_mqtt) lets an unauthenticated remote att
CVE-2026-67236 HIGH
8.2 Sep 25

The RabbitMQ management plugin in versions 4.2.0 through 4.2.8 and 4.3.0 through 4.3.2 writes an 'auth' cookie containin
CVE-2017-4966 HIGH
7.8 Jun 13

An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions p
CVE-2021-22117 HIGH
7.8 May 18

RabbitMQ installers on Windows prior to version 3.8.16 do not harden plugin directory permissions, potentially allowing

CVE-2026-67239 HIGH
7.6 Sep 25

Stored cross-site scripting (XSS) in the RabbitMQ stream management UI allows an attacker who can present a trusted TLS

Same weakness CWE-295 – Improper Certificate Validation

View all
CVE-2026-85102 CRITICAL POC
9.8
CVE-2015-3152 MEDIUM POC
5.9
CVE-2017-2800 CRITICAL POC
9.8
CVE-2014-1266 HIGH POC
7.4
CVE-2022-47758 CRITICAL POC
9.8
CVE-2025-68121 CRITICAL POC
10.0
CVE-2025-29331 CRITICAL POC
9.8
CVE-2025-32878 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Module for Server Applications 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected

Share

CVE-2026-67404 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy