# CVE-2026-67409

RabbitMQ JWKS fetch ignores HTTP status, causing persistent OAuth/JWT authentication DoS.

- Page: https://www.vulneraibility.com/cve/CVE-2026-67409
- CVSS: 8.2
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.42% (percentile 36.4)
- CISA SSVC: exploitation poc, automatable no, technical impact partial (assessed 2026-09-25)
- Weakness: CWE-252
- Also known as: GHSA-qw3h-qqm9-jrw8
- Published: 2026-09-25

## Affected versions

- rabbitmq: affected >= 3.13.0 and < 3.13.18; >= 4.0.0 and < 4.0.23; >= 4.1.0 and < 4.1.14; >= 4.2.0 and < 4.2.9; >= 4.3.0 and < 4.3.3; fixed in 3.13.18, 4.0.23, 4.1.14, 4.2.9, 4.3.3 (Bitnami advisory, via OSV)
- rabbitmq rabbitmq-server: affected >= 4.3.0 and < 4.3.3; >= 4.2.0 and < 4.2.9; >= 4.1.0 and < 4.1.14; >= 4.0.0 and < 4.0.23; >= 3.13.0 and < 3.13.18

A version outside these ranges is not a statement that it is unaffected.

## Impact

Persistent authentication denial-of-service: JWKS error responses wipe cached signing keys, blocking all OAuth2/JWT auth until a successful refresh.

## Action

Patch when possible

## Recommendation

Upgrade to fixed versions (see advisory) and monitor JWKS responses; validate JWKS endpoint availability.

## References

- [other] https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-qw3h-qqm9-jrw8
- [other] https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9
- [other] https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.