Improper Certificate Validation in RabbitMQ Server - #VU137242
Published: July 9, 2026
Vulnerability identifier: #VU137242
CSH Severity: High
CVSS v4 BT: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: N/A
CWE-ID: CWE-295
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to forge JWKS responses and cause the broker to accept arbitrary JWTs.
The vulnerability exists due to improper certificate validation in ssl_options/1 when fetching JWKS data with no CA bundle available. A remote attacker can perform a man-in-the-middle attack to forge JWKS responses and cause the broker to accept arbitrary JWTs.
The issue requires the OAuth2 plugin to be in use with no cacertfile configured and an empty or unreadable OS CA bundle.
Affected software
RabbitMQ Server
Remediation
Install security update from vendor's website.
RabbitMQ Server - addressed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6