CVE-2026-66071: RabbitMQ: Atom exhaustion: OAuth2 JWT tag: scope values
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.22 and 4.1.11 and 4.2.6 and 4.3.1, Atom exhaustion: OAuth2 JWT tag: scope values. extractscopes/1 parses scopes of the form .tag: and calls rabbitdatacoercion:toatom() to convert to a tag atom. The token signature is verified first, so the attacker cannot forge scopes , but in IdP configurations where scope content is user-influenced, each login with a novel tag value leaks one In deployments where users can influence the scopes included in their IdP-issued JWT rabbitmqauthbackendoauth2 enabled IdP permits attacker-influenced scope values in signed tokens. This issue is fixed in versions 3.13.15 and 4.0.22 and 4.1.11 and 4.2.6 and 4.3.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 3.13.15 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.0.22 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.1.11 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.2.6 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.3.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using rabbitmq_auth_backend_oauth2 are exposed when their identity provider allows users to influence scope values included in signed JWTs. The issue affects RabbitMQ versions from 3.13.0 before 3.13.15, and the affected 4.x releases prior to the listed fixed versions.
Does exploiting this require forging or modifying a JWT?
No. RabbitMQ verifies the token signature before parsing scopes, so an attacker cannot exploit this by forging scopes. Exploitation depends on obtaining legitimately signed tokens containing attacker-influenced, novel tag scope values.
What is the impact of repeated malicious logins?
Each login with a previously unseen tag value causes an atom to be leaked. Repeated logins using novel tag values can exhaust available atoms.
How can the issue be remediated?
Upgrade to RabbitMQ 3.13.15, 4.0.22, 4.1.11, 4.2.6, or 4.3.1. If an upgrade cannot be applied immediately, restrict the identity provider so users cannot influence scope values in signed JWTs.