Is CVE-2026-67409 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67409 being exploited in the wild.

How severe is CVE-2026-67409?

Informational severity, published 25 September 2026.

Which products and versions are affected?

RabbitMQ 3.13.0 to 3.13.17, 4.0.0 to 4.0.22, 4.1.0 to 4.1.13, 4.2.0 to 4.2.8, 4.3.0 to 4.3.2.

Is there a fix for CVE-2026-67409?

A patch was published on 2026-07-20: Fixed in versions 3.13.18, 4.0.23, 4.1.14, 4.2.9, 4.3.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-67409 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-67409?

Check whether you run RabbitMQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67409: RabbitMQ JWKS fetch ignores HTTP response status code

CVE-2026-67409 · Severity: info · Published 2026-09-25

RabbitMQ is a message broker that uses OAuth2 and JWT tokens to authenticate users. When fetching signing keys from an OAuth2 provider, the software ignores HTTP error responses and processes them as valid, destroying previously cached keys if the error response contains JSON without a keys field. This causes all OAuth2-authenticated users to be locked out of the system until the keys are refreshed.

Technologies: RabbitMQ. Vendors: RabbitMQ.

Quick answers

Is CVE-2026-67409 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67409 being exploited in the wild.
How severe is CVE-2026-67409?: Informational severity, published 25 September 2026.
Which products and versions are affected?: RabbitMQ 3.13.0 to 3.13.17, 4.0.0 to 4.0.22, 4.1.0 to 4.1.13, 4.2.0 to 4.2.8, 4.3.0 to 4.3.2.
Is there a fix for CVE-2026-67409?: A patch was published on 2026-07-20: Fixed in versions 3.13.18, 4.0.23, 4.1.14, 4.2.9, 4.3.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67409 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-67409?: Check whether you run RabbitMQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The JWKS key fetching mechanism in uaajwt.erl does not validate the HTTP response status code when downloading signing keys, matching any HTTP response pattern regardless of success. When the JWKS endpoint returns a 4xx or 5xx error with a valid-JSON body lacking a keys field, all cached signing keys are destroyed, triggering persistent authentication denial of service. The vulnerability requires an unauthenticated attacker with network access to the OAuth2 provider endpoint or ability to trigger error responses.

Affected products

RabbitMQ RabbitMQ 3.13.0 to 3.13.17, 4.0.0 to 4.0.22, 4.1.0 to 4.1.13, 4.2.0 to 4.2.8, 4.3.0 to 4.3.2

Timeline

2026-09-25: disclosed
2026-07-20: patched: Fixed in versions 3.13.18, 4.0.23, 4.1.14, 4.2.9, 4.3.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.