Improper Certificate Validation in RabbitMQ Server - CVE-2026-67404
Published: July 9, 2026 / Updated: September 28, 2026
Vulnerability identifier: #VU137242
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-67404
CWE-ID: CWE-295
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to forge JWKS responses and cause the broker to accept arbitrary JWTs.
The vulnerability exists due to improper certificate validation in ssl_options/1 when fetching JWKS data with no CA bundle available. A remote attacker can perform a man-in-the-middle attack to forge JWKS responses and cause the broker to accept arbitrary JWTs.
The issue requires the OAuth2 plugin to be in use with no cacertfile configured and an empty or unreadable OS CA bundle.
Affected software
RabbitMQ Server
How to mitigate CVE-2026-67404
Install security update from vendor's website.
RabbitMQ Server - addressed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6