RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS (CWE-252). the JWKS key fetching mechanism in uaajwt.erl does not validate the HTTP response status code when downloading signing keys from the OAuth2 provider's JWKS endpoint. Non-200 responses (including 4xx and 5xx errors) are processed identically to successful responses. When the JWKS endpoint returns an error response with a valid-JSON body that lacks a keys field, all previously cached signing keys are destroyed, causing a persistent authentication denial of Files: deps/rabbitmqauthbackendoauth2/src/uaajwt.erl, lines 50-63 deps/rabbitmqauthbackendoauth2/src/uaajwks.erl, lines 5-7 deps/rabbitmqauthbackendoauth2/src/rabbitoauth2provider.erl, lines 98-107 Bug 1: HTTP status code ignored (uaajwt.erl:50-63): The Erlang httpc module returns {ok, {{HttpVersion, StatusCode, ReasonPhrase}, Headers, Body}}. The pattern {ok, {, , JwksBody}} matches ANY successful HTTP transaction Persistent authentication DoS: Once keys are destroyed, ALL OAuth2/JWT authentication fails for all users until a new successful JWKS refresh occurs Amplification: A single attacker can deny access to all legitimate OAuth2 users across the entire RabbitMQ. This issue is fixed in versions 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8933-1 advisory.

    It was discovered that RabbitMQ Server incorrectly handled CORS wildcard origin configuration. An attacker     could possibly use this issue to cause a cross-site request forgery attack. This issue only affected     Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
    (CVE-2026-66070)

    It was discovered that RabbitMQ Server incorrectly handled TLS peer-certificate DNs in the management UI.
    An attacker could possibly use this issue to cause a cross-site scripting attack. (CVE-2026-66077)

    It was discovered that RabbitMQ Server incorrectly handled AMQP 1.0 arrays with zero-width element     constructors. An attacker could possibly use this issue to cause a denial of service. This issue only     affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-66079)

    It was discovered that RabbitMQ Server trust-store plugin incorrectly validated client certificates. An     attacker could possibly use this issue to bypass TLS client authentication. This issue only affected     Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
    (CVE-2026-67231)

    It was discovered that RabbitMQ Server incorrectly handled WebSocket frame sizes. An attacker could     possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu     22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67232)

    It was discovered that RabbitMQ Server incorrectly handled content-header body sizes. An attacker could     possibly use this issue to cause a denial of service. (CVE-2026-67235)

    It was discovered that RabbitMQ Server incorrectly stored credentials in an insecure cookie. An attacker     could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 20.04 LTS,     Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67236)

    It was discovered that RabbitMQ Server incorrectly handled OAuth bearer tokens in bootstrap JavaScript. An     attacker could possibly use this issue to cause a cross-site scripting attack. This issue only affected     Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-67237)

    It was discovered that RabbitMQ Server incorrectly handled ETF-encoded PID node names. An attacker could     possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu     24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67238)

    It was discovered that RabbitMQ Server incorrectly handled TLS peer-certificate DNs in the stream     management UI. An attacker could possibly use this issue to cause a cross-site scripting attack. This     issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67239)

    It was discovered that RabbitMQ Server incorrectly handled OAuth2 SSL options when no CA certificates were     available. An attacker could possibly use this issue to bypass TLS verification. This issue only affected     Ubuntu 26.04 LTS. (CVE-2026-67404)

    It was discovered that RabbitMQ Server incorrectly validated HTTP response status codes when fetching JWKS     keys. An attacker could possibly use this issue to cause a denial of service. This issue only affected     Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67409)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of RabbitMQ installed on the remote host is 3.13.x prior to 3.13.18, or 4.0.x prior to 4.0.23, or 4.1.x prior to 4.1.14, or 4.2.x prior to 4.2.9, or 4.3.x prior to 4.3.3. It is, therefore, affected by multiple vulnerabilities:

  - The JWKS key fetching mechanism in uaa_jwt.erl does not validate the HTTP response status code when downloading     signing keys from the OAuth 2 provider's JWKS endpoint. Non-200 responses are processed identically to successful     ones, so an error body that lacks a keys field destroys all previously cached signing keys, causing a persistent     authentication denial of service for all OAuth 2 and JWT users. (CVE-2026-67409)

  - The LDAP authentication backend performs literal string substitution of ${username} into user_dn_pattern without     applying RFC 4514 DN escaping. Special characters in the username are not escaped, so a crafted username can shift     the bind DN into a different organizational unit and potentially resolve to a different, more privileged directory     entry. (CVE-2026-67223)

  - The stream management UI renders the TLS peer certificate subject and issuer distinguished names without output     escaping, allowing an attacker who can obtain a certificate signed by a CA that the stream TLS listener trusts, with     an attacker-chosen DN, to store script that executes when an operator views the stream connection detail page.
    (CVE-2026-67239)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18,     JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS     (CWE-252). the JWKS key fetching mechanism in uaajwt.erl does not validate the HTTP response status code     when downloading signing keys from the OAuth2 provider's JWKS endpoint. Non-200 responses (including 4xx     and 5xx errors) are processed identically to successful responses. When the JWKS endpoint returns an error     response with a valid-JSON body that lacks a keys field, all previously cached signing keys are destroyed,     causing a persistent authentication denial of Files: deps/rabbitmqauthbackendoauth2/src/uaajwt.erl, lines     50-63 deps/rabbitmqauthbackendoauth2/src/uaajwks.erl, lines 5-7     deps/rabbitmqauthbackendoauth2/src/rabbitoauth2provider.erl, lines 98-107 Bug 1: HTTP status code ignored     (uaajwt.erl:50-63): The Erlang httpc module returns {ok, {{HttpVersion, StatusCode, ReasonPhrase},     Headers, Body}}. The pattern {ok, {, , JwksBody}} matches ANY successful HTTP transaction Persistent     authentication DoS: Once keys are destroyed, ALL OAuth2/JWT authentication fails for all users until a new     successful JWKS refresh occurs Amplification: A single attacker can deny access to all legitimate OAuth2     users across the entire RabbitMQ. This issue is fixed in versions 4.3.3, 4.2.9, 4.1.14, 4.0.23, and     3.13.18. (CVE-2026-67409)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
367209	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : RabbitMQ Server vulnerabilities (USN-8933-1)	Nessus	Ubuntu Local Security Checks	Local	critical
362548	RabbitMQ 3.13.x < 3.13.18 / 4.0.x < 4.0.23 / 4.1.x < 4.1.14 / 4.2.x < 4.2.9 / 4.3.x < 4.3.3 Multiple Vulnerabilities	Nessus	Misc.	Local	high
350715	Linux Distros Unpatched Vulnerability : CVE-2026-67409	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-67409

high

Tenable Plugins

critical

high

high