Skip to main content

RabbitMQ CVE-2026-67409

| EUVDEUVD-2026-87159 HIGH
Unchecked Return Value (CWE-252)
2026-09-25 GitHub_M
Rabbitmq Server Rabbitmq
8.2
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
8.2 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.9 MEDIUM

Network-reachable and unauthenticated (AV:N/PR:N), but requires the OAuth2/JWKS backend and an error-returning refresh (AC:H); impact is availability-only (C:N/I:N/A:H).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

5
POC Analysis Generated
Sep 25, 2026 - 19:25 vuln.today
Metadata Corrected
Sep 25, 2026 - 17:40 vuln.today
tag: Information Disclosure Denial Of Service
Patch available
Sep 25, 2026 - 17:04 EUVD
Analysis Generated
Sep 25, 2026 - 16:52 vuln.today
CVE Published
Sep 25, 2026 - 16:18 cve.org
HIGH 8.2

DescriptionCVE.org

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS (CWE-252). the JWKS key fetching mechanism in uaajwt.erl does not validate the HTTP response status code when downloading signing keys from the OAuth2 provider's JWKS endpoint. Non-200 responses (including 4xx and 5xx errors) are processed identically to successful responses. When the JWKS endpoint returns an error response with a valid-JSON body that lacks a keys field, all previously cached signing keys are destroyed, causing a persistent authentication denial of Files: deps/rabbitmqauthbackendoauth2/src/uaajwt.erl, lines 50-63 deps/rabbitmqauthbackendoauth2/src/uaajwks.erl, lines 5-7 deps/rabbitmqauthbackendoauth2/src/rabbitoauth2provider.erl, lines 98-107 Bug 1: HTTP status code ignored (uaajwt.erl:50-63): The Erlang httpc module returns {ok, {{HttpVersion, StatusCode, ReasonPhrase}, Headers, Body}}. The pattern {ok, {, , JwksBody}} matches ANY successful HTTP transaction Persistent authentication DoS: Once keys are destroyed, ALL OAuth2/JWT authentication fails for all users until a new successful JWKS refresh occurs Amplification: A single attacker can deny access to all legitimate OAuth2 users across the entire RabbitMQ. This issue is fixed in versions 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18.

AnalysisAI

Authentication denial of service in RabbitMQ affects deployments running the rabbitmq_auth_backend_oauth2 plugin from 3.13.0 through the fixed releases (4.3.3, 4.2.9, 4.1.14, 4.0.23, 3.13.18), where the JWKS signing-key fetch routine in uaajwt.erl fails to check the HTTP response status code and treats any well-formed HTTP transaction as a success, so a single non-200 response with valid JSON that lacks a 'keys' field wipes all cached signing keys and breaks OAuth2/JWT authentication for every user until the next successful refresh. The vulnerability is remotely reachable and unauthenticated (CVSS:4.0 PR:N / independent CVSS:3.1 PR:N), but exploitation depends on attack requirements being met (AT:P) - the attacker must induce or coincide with an error-returning JWKS response - and the resulting impact is a persistent availability outage (VC:N/VI:N/VA:H in the assessed vector, C:N/I:N/A:H in the independent 3.1 assessment), with no data exposure or code execution. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitable only when RabbitMQ (3.13.0 through the fixed releases) is deployed with the rabbitmq_auth_backend_oauth2 plugin configured to fetch signing keys from an OAuth2 provider's JWKS endpoint. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine availability threat but not a top-tier emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply the vendor fix by upgrading to RabbitMQ 4.3.3, 4.2.9, 4.1.14, 4.0.23, or 3.13.18 (Vendor-released patch), choosing the release in the maintenance line you already run; review the advisory at https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-qw3h-qqm9-jrw8 and the release notes at https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3 and https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9 before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all RabbitMQ clusters running rabbitmq_auth_backend_oauth2, particularly versions 3.13.0 through the fixed-release thresholds 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, and confirm vendor patch availability because the advisory text references fixed releases while the input patch status indicates no vendor-released patch identified at time of analysis; enable monitoring for OAuth2/JWT authentication failures and JWKS refresh errors and restrict unnecessary network access to RabbitMQ management and auth endpoints. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Rabbitmq Server

View all
CVE-2026-57219 HIGH POC
8.7 Jul 10

Sensitive credential disclosure in RabbitMQ affects installations running the management plugin with OAuth 2 configured

CVE-2019-11287 HIGH POC
7.5 Nov 23

Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x ver
CVE-2016-9877 CRITICAL
9.8 Dec 29

An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.
CVE-2025-50200 MEDIUM POC
5.5 Jun 19

RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in
CVE-2026-67404 CRITICAL
9.2 Sep 23

RabbitMQ brokers that use the OAuth2 plugin can silently fall back to disabled TLS certificate verification when no CA b
CVE-2026-67231 CRITICAL
9.1 Sep 23

TLS client-authentication bypass in the RabbitMQ trust-store plugin lets a remote unauthenticated attacker whose forged

CVE-2026-67410 HIGH
8.2 Sep 25

OAuth2 client secret disclosure in the RabbitMQ Management UI affects versions 4.2.0 through 4.2.8 and 4.3.0 through 4.3
CVE-2026-67232 HIGH
8.2 Sep 23

Memory-exhaustion denial of service in RabbitMQ's Web-MQTT plugin (rabbitmq_web_mqtt) lets an unauthenticated remote att
CVE-2026-67236 HIGH
8.2 Sep 25

The RabbitMQ management plugin in versions 4.2.0 through 4.2.8 and 4.3.0 through 4.3.2 writes an 'auth' cookie containin
CVE-2017-4966 HIGH
7.8 Jun 13

An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions p
CVE-2021-22117 HIGH
7.8 May 18

RabbitMQ installers on Windows prior to version 3.8.16 do not harden plugin directory permissions, potentially allowing

CVE-2026-67239 HIGH
7.6 Sep 25

Stored cross-site scripting (XSS) in the RabbitMQ stream management UI allows an attacker who can present a trusted TLS

Same weakness CWE-252 – Unchecked Return Value

View all
CVE-2021-26955 CRITICAL POC
9.8
CVE-2021-26958 HIGH POC
8.8
CVE-2019-15942 HIGH POC
8.8
CVE-2020-6078 HIGH POC
7.5
CVE-2026-85649 HIGH POC
7.9
CVE-2023-40303 HIGH POC
7.8
CVE-2020-6152 HIGH POC
7.8
CVE-2022-40279 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Module for Server Applications 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected

Share

CVE-2026-67409 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy