Rabbitmq server: RabbitMQ is a messaging and streaming broker. (CVE-2026-67409)
Description
RabbitMQ versions from 3.13.0 up to but not including 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18 contain a vulnerability where the JWKS key fetching mechanism ignores HTTP response status codes. This causes the system to treat error responses as successful, leading to destruction of cached signing keys and a persistent denial of service for OAuth2 authentication until a new successful JWKS refresh occurs. This allows an attacker to deny access to all OAuth2 users on the RabbitMQ server. The issue is fixed in versions 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18.
CVSS v3.1
Score 6.5medium
Affected software
pkg:deb/ubuntu/rabbitmq-server?arch=source&distro=esm-infra-legacy/xenialpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=esm-infra/bionicpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=esm-infra/focalpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=jammypkg:deb/ubuntu/rabbitmq-server?arch=source&distro=noblepkg:deb/ubuntu/rabbitmq-server?arch=source&distro=stonkingpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-67409 affects RabbitMQ's OAuth2 JWKS key fetching mechanism in uaajwt.erl, which does not validate HTTP response status codes when downloading signing keys. Non-200 HTTP responses with valid JSON but missing keys cause all cached signing keys to be destroyed, resulting in a persistent authentication denial of service for all OAuth2 users until a successful JWKS refresh. This vulnerability affects RabbitMQ versions from 3.13.0 up to but not including 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18. The flaw is fixed in these versions. The vulnerability has a CVSS 3.1 score of 6.5 (medium severity) with an impact on availability but no confidentiality or integrity impact.
Potential Impact
An attacker can cause a denial of service for all OAuth2 authenticated users by triggering JWKS endpoint error responses that lead to destruction of cached signing keys. This results in persistent authentication failures until the JWKS keys are successfully refreshed again. The impact affects availability of authentication services but does not compromise confidentiality or integrity.
Mitigation Recommendations
A patch is available and should be applied. The issue is fixed in RabbitMQ versions 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18. Users should upgrade to these or later versions to remediate this vulnerability. No other mitigations are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-67409
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Patch Information
Threat ID: 6ad3f5a72cdf04f6566627d9
Added to database: 10/17/2026, 22:24:39 UTC
Last enriched: 10/17/2026, 23:55:49 UTC
Last updated: 10/17/2026, 23:55:49 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.