CVE-2026-67409 Overview
CVE-2026-67409 affects RabbitMQ, a widely deployed messaging and streaming broker. The flaw resides in the OAuth2 authentication backend, specifically in how the JSON Web Key Set (JWKS) fetching mechanism in uaa_jwt.erl handles HTTP responses. The code processes any HTTP response identically, regardless of status code. When the JWKS endpoint returns a non-200 response with a JSON body missing the keys field, RabbitMQ destroys all cached signing keys. This triggers a persistent authentication denial of service for every OAuth2/JWT user. The issue is tracked as [CWE-252: Unchecked Return Value] and is fixed in versions 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18.
Critical Impact
A single network-reachable attacker can destroy cached JWKS signing keys and deny OAuth2 authentication for all users across the RabbitMQ cluster.
Affected Products
- RabbitMQ Server versions 3.13.0 through 3.13.17
- RabbitMQ Server versions 4.0.0 through 4.0.22, 4.1.0 through 4.1.13, 4.2.0 through 4.2.8
- RabbitMQ Server versions 4.3.0 through 4.3.2 using the rabbitmq_auth_backend_oauth2 plugin
Discovery Timeline
- 2026-09-25 - CVE-2026-67409 published to NVD
- 2026-09-28 - Last updated in NVD database
Technical Details for CVE-2026-67409
Vulnerability Analysis
The vulnerability lives in the rabbitmq_auth_backend_oauth2 plugin, which validates JWT tokens issued by an external OAuth2 provider. To validate signatures, RabbitMQ periodically fetches signing keys from the provider's JWKS endpoint. The fetching logic in uaa_jwt.erl lines 50-63 uses Erlang's httpc module and pattern-matches on {ok, {_, _, JwksBody}}. This pattern accepts any HTTP response, including 4xx and 5xx errors, as long as the transport layer succeeds. The response body is then parsed and the resulting key set replaces the previously cached keys in uaa_jwks.erl. When an error page returns valid JSON without a keys field, the cache is overwritten with an empty set, breaking authentication until a subsequent successful refresh occurs.
Root Cause
The root cause is an unchecked HTTP status code. The code assumes a successful HTTP transaction implies a valid JWKS payload. No validation separates 200 OK responses from error responses before replacing the signing key cache in rabbit_oauth2_provider.erl lines 98-107.
Attack Vector
An attacker able to influence responses from the configured JWKS endpoint can trigger the condition. This includes operators of a compromised identity provider, attackers performing DNS or BGP hijacking, or on-path adversaries intercepting traffic to the OAuth2 provider. A single malformed response causes RabbitMQ to purge valid signing keys. All OAuth2/JWT authentication attempts then fail until the next successful JWKS refresh populates the cache again. The condition can be sustained if the attacker continues to serve error responses on each refresh interval.
Detection Methods for CVE-2026-67409
Indicators of Compromise
- Sudden surge of OAuth2/JWT authentication failures across all users with no corresponding configuration change.
- RabbitMQ logs showing JWKS refresh events immediately followed by signature validation errors referencing missing or unknown key IDs.
- Non-200 HTTP responses observed from the configured JWKS endpoint in network telemetry.
Detection Strategies
- Inspect RabbitMQ broker logs for repeated JWT validation errors tied to the rabbitmq_auth_backend_oauth2 plugin.
- Monitor outbound HTTP calls from RabbitMQ nodes to the JWKS endpoint and alert on non-200 status codes.
- Correlate authentication failure spikes with recent JWKS refresh activity to identify the window of key destruction.
Monitoring Recommendations
- Instrument the OAuth2 identity provider to emit alerts on 4xx and 5xx responses served to RabbitMQ user agents.
- Track the size and freshness of the cached JWKS set exposed by broker management metrics.
- Alert on sustained authentication failure rates exceeding a baseline threshold for OAuth2-authenticated producers and consumers.
How to Mitigate CVE-2026-67409
Immediate Actions Required
- Upgrade RabbitMQ to version 4.3.3, 4.2.9, 4.1.14, 4.0.23, or 3.13.18 depending on the deployed release branch.
- Audit network paths between RabbitMQ nodes and the OAuth2 provider for integrity, including DNS resolution and TLS certificate validation.
- Restrict outbound JWKS fetch traffic to the known identity provider endpoint using egress firewall rules.
Patch Information
The RabbitMQ team released fixes in RabbitMQ Server Release 4.3.3 and RabbitMQ Server Release 4.2.9, with backports for 4.1.14, 4.0.23, and 3.13.18. The patched code validates the HTTP status code before replacing the cached signing keys. Full details are in the GitHub Security Advisory GHSA-qw3h-qqm9-jrw8.
Workarounds
- Pin the JWKS endpoint to an internal, trusted mirror that cannot return error responses with JSON bodies.
- Fall back to an alternative authentication backend such as internal credentials or LDAP for critical service accounts until patches are deployed.
- Increase the JWKS refresh interval and monitor it closely to reduce the window during which malformed responses can poison the cache.
# Verify installed RabbitMQ version on affected nodes
rabbitmqctl version
# List enabled plugins to confirm OAuth2 backend usage
rabbitmq-plugins list -e | grep rabbitmq_auth_backend_oauth2
# Restrict outbound JWKS traffic to a trusted IdP host (example iptables rule)
iptables -A OUTPUT -p tcp -d idp.example.com --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -m owner --uid-owner rabbitmq -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
