RabbitMQ's trust-store plugin improperly validates TLS client certificates by overriding errors for certificates that match a whitelist based solely on the issuer's distinguished name and serial number, without verifying the public key or signature. The whitelist check uses a simple ETS member lookup and does not perform full certificate path validation, as the trust anchors list is empty. This flaw enables an attacker who knows or can guess the issuer DN and serial number of a whitelisted certificate to connect using a forged self-signed certificate, effectively bypassing TLS client authentication. The vulnerability affects rabbitmq-server versions >=3.13.0 <3.13.15, >=4.0.0 <4.0.20, >=4.1.0 <4.1.11, and >=4.2.0 <4.2.6. It is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

An attacker who can guess or know the issuer distinguished name and serial number of a whitelisted certificate can bypass TLS client authentication on affected RabbitMQ servers with the trust-store plugin enabled. This allows unauthorized access to the messaging broker, potentially leading to unauthorized message publishing or consumption. The vulnerability does not require privileges or user interaction and has a high impact on confidentiality and integrity of communications.

A fixed version of rabbitmq-server is available: upgrade to 3.13.15, 4.0.20, 4.1.11, 4.2.6, or later. The vendor has released official fixes addressing this improper certificate validation issue. If upgrading immediately is not possible, consider disabling the rabbitmq_trust_store plugin or avoiding its use as the TLS verify function until patched. Patch status is confirmed by the vendor advisory.