Rabbitmq server: RabbitMQ is a messaging and streaming broker. (CVE-2026-67223)

This vulnerability in RabbitMQ server involves the rabbitmq_auth_backend_ldap plugin where the user_dn_pattern substitutes the ${username} variable without proper RFC 4514 DN escaping. This allows an attacker to craft a username that modifies the LDAP bind DN, potentially selecting a different directory entry. Successful exploitation requires the plugin enabled with a vulnerable user_dn_pattern, a directory layout that resolves the injected suffix usefully, and a valid password for the resulting DN. The advisory identifies affected maintenance lines 3.13, 4.0, 4.1, 4.2, and 4.3, but there is conflicting information about the exact fixed versions. The vulnerability has a CVSS 3.1 score of 7.1, indicating a medium severity impact primarily affecting confidentiality.

An attacker who can supply a crafted username to the LDAP authentication backend can manipulate the LDAP bind DN, potentially authenticating as a different directory entry. This could lead to unauthorized access to RabbitMQ resources if the attacker has valid credentials for the manipulated DN. The impact is primarily on confidentiality with limited integrity impact and no availability impact reported.

Fixed versions are reported but conflicting between advisory text and metadata. Versions 3.13.15, 4.0.20, 4.1.11, 4.2.9, and 4.3.3 are cited as fixed in the advisory, while metadata suggests 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3. Users should apply the latest available patches for their maintenance line once the vendor confirms the exact fixed versions. Until then, carefully review LDAP user_dn_pattern configurations to avoid using unescaped ${username} substitutions. No known exploits are reported in the wild.