CVE-2026-66071: RabbitMQ OAuth2 Information Disclosure Flaw

CVE-2026-66071 is an information disclosure vulnerability in RabbitMQ messaging broker affecting OAuth2 JWT authentication. Attackers can exploit atom exhaustion through user-influenced scope values. This article covers technical details, affected versions from 3.13.0 to 4.3.0, impact analysis, and mitigation strategies.

CVE-2026-66071 Overview

CVE-2026-66071 affects RabbitMQ, an open-source messaging and streaming broker. The vulnerability resides in the rabbitmq_auth_backend_oauth2 plugin, which parses scope values from signed JSON Web Tokens (JWTs). The extract_scopes/1 function calls rabbit_data_coercion:to_atom() on tag portions of scopes formatted as .tag:<value>. Because Erlang atoms are never garbage-collected, each novel tag value consumes a slot in the global atom table. In Identity Provider (IdP) configurations where authenticated users can influence scope content, each login with a new tag value leaks one atom, eventually exhausting the atom table and crashing the broker.

Critical Impact
An authenticated attacker with influence over IdP-issued JWT scope values can trigger atom table exhaustion, resulting in denial of service against the RabbitMQ broker.

Affected Products

RabbitMQ Server 3.13.0 through 3.13.14
RabbitMQ Server 4.0.x through 4.0.21, 4.1.x through 4.1.10, 4.2.x through 4.2.5
RabbitMQ Server 4.3.0 (with rabbitmq_auth_backend_oauth2 enabled)

Discovery Timeline

2026-09-25 - CVE-2026-66071 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-66071

Vulnerability Analysis

The flaw is classified as uncontrolled resource consumption [CWE-400]. RabbitMQ runs on the Erlang/OTP runtime, where atoms are interned symbols stored in a fixed-size table (default limit 1,048,576). Atoms are never freed during the VM lifetime. When the OAuth2 backend processes a JWT, scopes shaped like resource.tag:value cause the tag component to be converted into an atom via rabbit_data_coercion:to_atom().

The token signature is verified before scope extraction, so attackers cannot forge arbitrary scopes. However, in deployments where the IdP permits user-controlled or user-influenced scope claims in signed tokens, a legitimate authenticated user can request novel tag values with each login. Over time, the atom table fills and the Erlang VM crashes, taking the broker offline.

Root Cause

The root cause is unbounded conversion of untrusted string input into Erlang atoms within rabbit_auth_backend_oauth2.erl. The extract_scopes/1 function did not enforce an upper bound on the number of scopes processed per token, nor did it restrict the cardinality of distinct tag atoms created across sessions.

Attack Vector

Exploitation requires network access to the broker and valid credentials at an IdP that both issues RabbitMQ-trusted tokens and allows user-influenced scope values. The attacker repeatedly authenticates, each time embedding a fresh unique tag string in the token scopes. Each successful login leaks one atom. No privilege escalation or user interaction is required beyond repeated authentication.

text

// Patch excerpt — deps/rabbitmq_auth_backend_oauth2/src/rabbit_auth_backend_oauth2.erl
     filter_matching_scope_prefix/2,
     filter_matching_scope_prefix_and_drop_it/2]).
 
+-define(MAX_SCOPE_COUNT, 2048).
+
 -ifdef(TEST).
 -compile(export_all).
 -endif.

Source: RabbitMQ Commit 9a44124. The patch introduces a MAX_SCOPE_COUNT ceiling of 2048 scopes per token to cap atom creation per authentication event.

Detection Methods for CVE-2026-66071

Indicators of Compromise

Steadily rising Erlang atom count reported by erlang:system_info(atom_count) without a corresponding increase in queues, exchanges, or connections.
Authentication logs from rabbitmq_auth_backend_oauth2 showing repeated logins from the same subject with varied .tag: scope values.
Broker crashes with system_limit errors referencing atom table exhaustion.

Detection Strategies

Monitor the Erlang atom table using Prometheus metrics exported by RabbitMQ (erlang_vm_atoms) and alert on sustained growth.
Inspect decoded JWT scope claims at the IdP or proxy layer for high-cardinality .tag: values originating from a single principal.
Correlate OAuth2 authentication events with broker memory and VM telemetry to surface anomalous scope diversity.

Monitoring Recommendations

Enable detailed logging on rabbitmq_auth_backend_oauth2 and ship logs to a centralized analytics platform for scope-content review.
Baseline normal atom growth rates per broker and alert on deviations exceeding the baseline by a defined threshold.
Track the ratio of unique scope values to authentications per subject over rolling windows to flag abuse early.

How to Mitigate CVE-2026-66071

Immediate Actions Required

Upgrade RabbitMQ to a fixed release: 3.13.15, 4.0.22, 4.1.11, 4.2.6, or 4.3.1.
Audit IdP configurations to determine whether authenticated users can influence scope values embedded in signed JWTs.
Restrict IdP scope issuance policies so that .tag: components are drawn from a controlled, finite vocabulary.

Patch Information

The fix introduces -define(MAX_SCOPE_COUNT, 2048) in rabbit_auth_backend_oauth2.erl, capping the number of scopes processed per JWT. See RabbitMQ Security Advisory GHSA-89p2-f5cv-x5cg, RabbitMQ Release v4.2.6, and RabbitMQ Release v4.3.1. Additional backport commits are available at RabbitMQ Commit 9a44124 and RabbitMQ Commit c5690583.

Workarounds

Disable the rabbitmq_auth_backend_oauth2 plugin if OAuth2 authentication is not required.
Configure the IdP to issue only server-controlled scope claims; strip or validate client-requested scopes before signing.
Raise the Erlang atom table limit as a short-term buffer and schedule periodic broker restarts until patches are applied.

bash

# Verify installed RabbitMQ version and plan upgrade to a fixed release
rabbitmqctl version

# Disable the OAuth2 backend as a temporary mitigation
rabbitmq-plugins disable rabbitmq_auth_backend_oauth2

# Inspect current atom usage on the broker node
rabbitmqctl eval 'erlang:system_info(atom_count).'