This vulnerability involves improper neutralization of special elements used in an LDAP query (CWE-90) within rabbitmq-server. The fill/2 function substitutes the ${username} variable into the user_dn_pattern without applying RFC 4514 Distinguished Name escaping, enabling an attacker to craft a username that alters the LDAP bind DN. Successful exploitation requires the rabbitmq_auth_backend_ldap plugin configured with a user_dn_pattern containing ${username}, a directory structure where the injected suffix is meaningful, and a valid password for the manipulated DN. The advisory lists fixed versions as 3.13.15, 4.0.20, 4.1.11, 4.2.9, and 4.3.3, but structured metadata conflicts with these, listing 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3. Until this conflict is resolved by a curator, fixed version assertions remain uncertain.

An attacker can manipulate the LDAP bind DN by injecting crafted usernames due to lack of proper escaping, potentially allowing authentication as a different directory entry if the attacker knows a valid password for that entry. This could lead to unauthorized access or privilege escalation within systems relying on LDAP authentication via rabbitmq_auth_backend_ldap.

Patch status is not yet confirmed due to conflicting fixed version information. Users should consult the official vendor advisory for the latest remediation guidance. Until fixed versions are confirmed and applied, avoid using user_dn_pattern configurations that include unescaped ${username} variables or restrict LDAP authentication usage. Monitor vendor communications for updates resolving the fixed version conflicts.