CVE-2026-67404 - RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch

Back Back to CVE browser

CRITICAL

RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch

Published Sep 23, 2026

9.2

CRITICAL

CVSS 4.0

EPSS 0.24%

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, When no CA bundle is available, ssl_options/1 falls back to [{verify, verify_none}] with no warning. An attacker in a man-in-the-middle position can forge the JWKS response, which leads the broker to accept arbitrary JWTs. Preconditions include The OAuth2 plugin must be in use with no cacertfile configured and the OS CA bundle empty or unreadable (for example, in a minimal container), and the attacker must hold a network man-in-the-middle position.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

Affected products

Vendor Rabbitmq Product Rabbitmq-Server Default
n/a
- Version
  >= 3.13.0, < 3.13.15
  Status
  affected
  Constraints
  -
- Version
  >= 4.0.0, < 4.0.20
  Status
  affected
  Constraints
  -
- Version
  >= 4.1.0, < 4.1.11
  Status
  affected
  Constraints
  -
- Version
  >= 4.2.0, < 4.2.6
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Rabbitmq

Rabbitmq-Server

n/a

Version	Status	Constraints
>= 3.13.0, < 3.13.15	affected	-
>= 4.0.0, < 4.0.20	affected	-
>= 4.1.0, < 4.1.11	affected	-
>= 4.2.0, < 4.2.6	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-295

Improper Certificate Validation

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-85631
Advisory
https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6
x_refsource_MISC
https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-37wx-r6q9-6fhj
x_refsource_CONFIRM

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-85631		Advisory
https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6		x_refsource_MISC
https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-37wx-r6q9-6fhj		x_refsource_CONFIRM