CVE-2026-67409
RabbitMQ is a messaging and streaming broker
- Risk score
- 51/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 25 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS (CWE-252). the JWKS key fetching mechanism in uaajwt.erl does not validate the HTTP response status code when downl…
- Affected
- Broadcom Rabbitmq Server before 4.3.3, 4.2.9, 4.1.14, 4.0.23, 3.13.18
- Fix
- Upgrade Broadcom Rabbitmq Server to 4.3.3, 4.2.9, 4.1.14, 4.0.23 or 3.13.18 (whichever matches your release line), or later.
- Exploitation
- Public proof of concept
Story map
At a glance
Broadcom Rabbitmq Server: Amber, patch this week. RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorization header or access_token cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token content to execute JavaScript in the management UI origin. T…
The flaws
- CVE-2026-67409: RabbitMQ is a messaging and streaming broker (CVSS 6.5 · EPSS 0%)
- CVE-2026-67237: RabbitMQ is a messaging and streaming broker (CVSS 9.3 · EPSS 0%)
- CVE-2026-66070: RabbitMQ is a messaging and streaming broker (CVSS 8.8 · EPSS 0%)
- CVE-2026-67231: RabbitMQ is a messaging and streaming broker (CVSS 9.1 · EPSS 0%)
The fix
Upgrade Broadcom Rabbitmq Server: 4.3.3 · 4.2.9 · 4.1.14 · 4.0.23 · 3.13.18 · 4.2.8 or later on your release line
Who is exposed: Broadcom Rabbitmq Server before 4.2.8, 4.3.2
Where it stands
- Public proof of concept
Connects to
- Same weakness: CWE-252 (CWE-252). 11 other warnings in 30 days
- Same product: Earlier Broadcom Rabbitmq Server warnings. 45 in the last 90 days
Why it is Yellow
- CVSS 6.5 medium
- Public exploit or proof of concept referenced
References
Original description
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS (CWE-252). the JWKS key fetching mechanism in uaajwt.erl does not validate the HTTP response status code when downloading signing keys from the OAuth2 provider's JWKS endpoint. Non-200 responses (including 4xx and 5xx errors) are processed identically to successful responses. When the JWKS endpoint returns an error response with a valid-JSON body that lacks a keys field, all previously cached signing keys are destroyed, causing a persistent authentication denial of Files: deps/rabbitmqauthbackendoauth2/src/uaajwt.erl, lines 50-63 deps/rabbitmqauthbackendoauth2/src/uaajwks.erl, lines 5-7 deps/rabbitmqauthbackendoauth2/src/rabbitoauth2provider.erl, lines 98-107 Bug 1: HTTP status code ignored (uaajwt.erl:50-63): The Erlang httpc module returns {ok, {{HttpVersion, StatusCode, ReasonPhrase}, Headers, Body}}. The pattern {ok, {, , JwksBody}} matches ANY successful HTTP transaction Persistent authentication DoS: Once keys are destroyed, ALL OAuth2/JWT authentication fails for all users until a new successful JWKS refresh occurs Amplification: A single attacker can deny access to all legitimate OAuth2 users across the entire RabbitMQ. This issue is fixed in versions 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18.
Last activity 25 Sep 2026. Patch Forecast updates every hour.