SSL Options Vulnerability in RabbitMQ Messaging Broker
CVE-2026-67404

9.2CRITICAL

Key Information:

Vendor

RabbitMQ

Status
RabbitMQ-server
Vendor
CVE Published:
23 September 2026

What is CVE-2026-67404?

An SSL configuration weakness in RabbitMQ allows an attacker in a man-in-the-middle position to forge JSON Web Key Set (JWKS) responses. This issue arises when the OAuth2 plugin is enabled without a configured CA certificate file, and the operating system's CA bundle is either empty or unreadable, which is common in minimal container setups. In such cases, the ssl_options/1 configuration defaults to verify_none, leading the broker to accept arbitrary JSON Web Tokens (JWTs) without any warnings. The vulnerability has been addressed in recent versions of RabbitMQ.

Affected Version(s)

rabbitmq-server >= 3.13.0, < 3.13.15 < 3.13.0, 3.13.15

rabbitmq-server >= 4.0.0, < 4.0.20 < 4.0.0, 4.0.20

rabbitmq-server >= 4.1.0, < 4.1.11 < 4.1.0, 4.1.11

References

https://github.com/rabbitmq/rabbitmq-server/security/advi...
x_refsource_CONFIRM
https://github.com/rabbitmq/rabbitmq-server/releases/tag/...
x_refsource_MISC

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.