CVE-2026-67409

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.17 RabbitMQ versions 4.0.0 through 4.0.22 RabbitMQ versions 4.1.0 through 4.1.13 RabbitMQ versions 4.2.0 through 4.2.8 RabbitMQ versions 4.3.0 through 4.3.2

Description The JWKS key fetching mechanism in uaajwt.erl fails to validate the HTTP response status code when downloading signing keys from the OAuth2 provider's JWKS endpoint. Consequently, non-200 responses, such as 4xx and 5xx errors, are treated as successful. If the endpoint returns an error response containing a valid JSON body that lacks a keys field, all previously cached signing keys are destroyed. This leads to a persistent authentication denial of service where all OAuth2/JWT authentication fails for all users until a successful JWKS refresh occurs, allowing a single attacker to deny access to all legitimate OAuth2 users.

Recommendations Update RabbitMQ to version 3.13.18. Update RabbitMQ to version 4.0.23. Update RabbitMQ to version 4.1.14. Update RabbitMQ to version 4.2.9. Update RabbitMQ to version 4.3.3.