JWT Key Fetching Flaw in RabbitMQ Messaging Broker
CVE-2026-67409
What is CVE-2026-67409?
A flaw exists in the JWKS key fetching mechanism of RabbitMQ versions 3.13.0 through 4.3.3, where the system fails to validate HTTP response status codes during the retrieval of signing keys from an OAuth2 provider's JWKS endpoint. This oversight allows for the mishandling of non-200 responses, which can lead to the destruction of all previously cached signing keys upon receiving an error response. Consequently, this results in a persistent denial of authentication for all users until a successful refresh of the JWKS occurs, creating a vulnerability that can be exploited by an attacker to disrupt access for legitimate users across the entire messaging platform.
Affected Version(s)
rabbitmq-server >= 4.3.0, < 4.3.3 < 4.3.0, 4.3.3
rabbitmq-server >= 4.2.0, < 4.2.9 < 4.2.0, 4.2.9
rabbitmq-server >= 4.1.0, < 4.1.14 < 4.1.0, 4.1.14