{"answers":{"affected":"1 open source package ship an affected version, including rabbitmq. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-67242 exists.","fix":"Upgrade rabbitmq to a fixed version for your release line: 4.2.9 or 4.3.3.","what":"CVE-2026-67242 is a medium-severity authentication bypass vulnerability in Broadcom Rabbitmq Server, published on 25 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-67242 and fix it if it is affected.\n\nWhat it is: CVE-2026-67242 is a medium-severity authentication bypass vulnerability in Broadcom Rabbitmq Server, published on 25 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-67242 exists.\n\nAffected packages and fixed versions:\n- rabbitmq (Bitnami): affected from 4.2.0; fixed in 4.2.9, 4.3.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-67242/ (Markdown: https://insights.sbomify.com/CVE-2026-67242/index.md)","id":"CVE-2026-67242","markdown":"https://insights.sbomify.com/CVE-2026-67242/index.md","name":"CVE-2026-67242","record":{"aliases":["BIT-rabbitmq-2026-67242","DEBIAN-CVE-2026-67242","GHSA-rrj4-g94f-rqj9","UBUNTU-CVE-2026-67242"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["security_bypass"],"network_reachable":"yes","non_default_config":true,"product_category":"RabbitMQ message broker","requires_auth":"none","summary":"Attackers can use expired OAuth2 tokens if the identity provider emits float expiry values, bypassing authentication checks in RabbitMQ.","user_interaction":"not_required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"rabbitmq_server","vendor":"broadcom"}],"cvss":{"score":6.3,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-613","name":"DEPRECATED: Insufficient Session Expiration"}],"description":"RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, OAuth2 isinteger(Exp) guard skips token-expiry checks for float exp. validatetokenexpiry/1 (lines 208-214) and expirytimestamp/1 (138-144) both guard with 'when isinteger(Exp)' and fall through to ok/never for float values. josejwt:verify validates only the signature, not exp. With float exp, no expiry validation occurs anywhere in the If the IdP emits exp as a JSON float (RFC 7519 permits fractional NumericDate), both the login-time expiry check and the mid-connection disconnect timer are silently skipped , an already-expired token is accepted, and connections never time OAuth2 backend enabled IdP emits float exp (uncommon; mainstream IdPs emit integers) Attacker possesses a previously-valid signed. This issue is fixed in versions 4.2.9 and 4.3.3.","ecosystems":["Bitnami"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"RabbitMQ: OAuth2 is_integer(Exp) guard skips token-expiry checks for float exp","id":"CVE-2026-67242","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Bitnami","product":"broadcom:rabbitmq_server","products":["broadcom:rabbitmq_server"],"type":"auth_bypass","year":"2026"},"n_packages":1,"n_references":5,"next":{"headline":"File upload in freo2","id":"CVE-2026-67243"},"packages":[{"ecosystem":"Bitnami","fixed":["4.2.9","4.3.3"],"introduced":["4.2.0","4.3.0"],"last_affected":[],"package":"rabbitmq","purl":"pkg:bitnami/rabbitmq","source":"BIT-rabbitmq-2026-67242"}],"prev":{"headline":"RabbitMQ: AMQP 1.0 management exchange.declare skips alternate-exchange permission check","id":"CVE-2026-67241"},"products":["rabbitmq-server"],"published":"2026-09-25","related":[{"cvss_score":9.8,"headline":"Auth bypass in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6; RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12 and 1.7.x before 1.7.7","id":"CVE-2016-9877","kev_date_added":null,"published":"2016-12-29"},{"cvss_score":9.2,"headline":"RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch","id":"CVE-2026-67404","kev_date_added":null,"published":"2026-09-23"},{"cvss_score":9.1,"headline":"RabbitMQ: Trust-store whitelist by Issuer+Serial only","id":"CVE-2026-67231","kev_date_added":null,"published":"2026-09-23"},{"cvss_score":8.7,"headline":"Information disclosure in rabbitmq-server","id":"CVE-2026-57219","kev_date_added":null,"published":"2026-07-10"},{"cvss_score":8.2,"headline":"RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login","id":"CVE-2026-67236","kev_date_added":null,"published":"2026-09-25"},{"cvss_score":8.2,"headline":"RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS","id":"CVE-2026-67409","kev_date_added":null,"published":"2026-09-25"},{"cvss_score":8.2,"headline":"RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint","id":"CVE-2026-67410","kev_date_added":null,"published":"2026-09-25"}],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"Bitnami","prefix":"BIT"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-09-25","vendors":["rabbitmq"]},"summary":"Attackers can use expired OAuth2 tokens if the identity provider emits float expiry values, bypassing authentication checks in RabbitMQ.","url":"https://insights.sbomify.com/CVE-2026-67242/"}