CVE-2026-67409

Analyzed Analyzed - Analysis Complete

Authentication DoS in RabbitMQ via JWKS Key Destruction

Publication date: 2026-09-25

Last updated on: 2026-10-08

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS (CWE-252). the JWKS key fetching mechanism in uaajwt.erl does not validate the HTTP response status code when downloading signing keys from the OAuth2 provider's JWKS endpoint. Non-200 responses (including 4xx and 5xx errors) are processed identically to successful responses. When the JWKS endpoint returns an error response with a valid-JSON body that lacks a keys field, all previously cached signing keys are destroyed, causing a persistent authentication denial of Files: deps/rabbitmqauthbackendoauth2/src/uaajwt.erl, lines 50-63 deps/rabbitmqauthbackendoauth2/src/uaajwks.erl, lines 5-7 deps/rabbitmqauthbackendoauth2/src/rabbitoauth2provider.erl, lines 98-107 Bug 1: HTTP status code ignored (uaajwt.erl:50-63): The Erlang httpc module returns {ok, {{HttpVersion, StatusCode, ReasonPhrase}, Headers, Body}}. The pattern {ok, {, , JwksBody}} matches ANY successful HTTP transaction Persistent authentication DoS: Once keys are destroyed, ALL OAuth2/JWT authentication fails for all users until a new successful JWKS refresh occurs Amplification: A single attacker can deny access to all legitimate OAuth2 users across the entire RabbitMQ. This issue is fixed in versions 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-08

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-67409

EUVD

EUVD-2026-87159

Affected Vendors & Products

Vendor	Product	Version / Range
broadcom	rabbitmq_server	From 4.1.0 (inc) to 4.1.14 (exc)
broadcom	rabbitmq_server	From 4.2.0 (inc) to 4.2.9 (exc)
broadcom	rabbitmq_server	From 4.3.0 (inc) to 4.3.3 (exc)
broadcom	rabbitmq_server	From 4.0.0 (inc) to 4.0.23 (exc)
broadcom	rabbitmq_server	From 3.13.0 (inc) to 3.13.18 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-252	The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

Attack-Flow Graph

Executive Summary

This vulnerability in RabbitMQ versions 3.13.0 to 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18 involves improper handling of HTTP responses when fetching signing keys from an OAuth2 provider's JWKS endpoint. The system does not check the HTTP status code, so even error responses (like 4xx or 5xx) are treated as valid, leading to destruction of cached signing keys. This causes persistent denial of authentication for all users until new keys are fetched.

Detection Guidance

Check RabbitMQ logs for failed authentication attempts or repeated JWKS key refresh failures. Monitor HTTP responses from OAuth2 providers to verify they return 200 status codes. Inspect Erlang modules uaajwt.erl and uaajwks.erl for improper HTTP status handling.

Impact Analysis

This vulnerability allows an attacker to deny authentication access to all legitimate users of RabbitMQ by triggering an error response from the JWKS endpoint. This results in a persistent denial of service (DoS) where no users can authenticate via OAuth2/JWT until the issue is manually resolved or new keys are fetched.

Compliance Impact

This vulnerability could lead to a denial of service for authentication systems, potentially causing unauthorized access to sensitive data or service disruptions. For GDPR, this may impact data availability and integrity, while for HIPAA, it could disrupt access to protected health information, both of which are critical compliance requirements.

Mitigation Strategies

Upgrade RabbitMQ to version 4.3.3, 4.2.9, 4.1.14, 4.0.23, or 3.13.18 or later. Temporarily disable OAuth2 authentication if an upgrade is not immediately possible. Configure network monitoring to alert on non-200 responses from JWKS endpoints.

Hi! I’m here to help you understand CVE-2026-67409. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70