CVE-2026-67404 – rabbitmq-server

This RabbitMQ update closes two Critical authentication flaws in rabbitmq-server that let attackers bypass identity checks and gain elevated access to the message broker. CVE-2026-67231 has a CVSS score of 9.1, Critical severity. A flaw in the trust-store plugin matches whitelisted certificates by issuer name and serial number alone, so an attacker who knows those non-secret values can connect with a forged self-signed certificate and bypass TLS client authentication. CVE-2026-67404 has a CVSS score of 9.2, Critical severity. When the OAuth2 plugin has no CA bundle available, the broker silently disables certificate verification, letting a man-in-the-middle attacker forge signing keys and have the broker accept arbitrary tokens.

Both flaws are fixed in RabbitMQ versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. Deployments using the trust-store plugin or OAuth2 authentication, including minimal containers without an OS CA bundle, should upgrade now to restore trusted authentication across their messaging infrastructure.