What’s Vulnerable › Vulnerabilities

CVE-2026-66071: RabbitMQ: Atom exhaustion: OAuth2 JWT tag: scope values

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-09-25 · updated 2026-10-15
• Weakness: CWE-400

Description

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.22 and 4.1.11 and 4.2.6 and 4.3.1, Atom exhaustion: OAuth2 JWT tag: scope values. extractscopes/1 parses scopes of the form .tag: and calls rabbitdatacoercion:toatom() to convert to a tag atom. The token signature is verified first, so the attacker cannot forge scopes , but in IdP configurations where scope content is user-influenced, each login with a novel tag value leaks one In deployments where users can influence the scopes included in their IdP-issued JWT rabbitmqauthbackendoauth2 enabled IdP permits attacker-influenced scope values in signed tokens. This issue is fixed in versions 3.13.15 and 4.0.22 and 4.1.11 and 4.2.6 and 4.3.1.

Affected products

• rabbitmq-server: from 3.13.0 before 3.13.15; from 4.0.0 before 4.0.22; from 4.1.0 before 4.1.11; from 4.2.0 before 4.2.6; from 4.3.0 before 4.3.1 — fixed in 3.13.15, 4.0.22, 4.1.11, 4.2.6, 4.3.1

How to fix

Upgrade to a fixed version: rabbitmq-server 3.13.15, 4.0.22, 4.1.11, 4.2.6. Check the vendor advisory for mitigations.

References

• https://github.com/rabbitmq/rabbitmq-server/commit/9a44124d9c932d6fc7d2a3b945e5a143e547bcb6
• https://github.com/rabbitmq/rabbitmq-server/commit/c5690583a53789a3bf00cca508b43e8246db0d11
• https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6
• https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1
• https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-89p2-f5cv-x5cg

Get alerted when CVE-2026-66071 or the next vulnerability affects your stack