Rabbitmq server: RabbitMQ is a messaging and streaming broker. (CVE-2026-67231)

The RabbitMQ trust-store plugin installs a verify_fun that overrides certain certificate errors when the presented certificate matches a whitelisted one by issuer and serial number only. The matching does not consider public key, SKI, fingerprint, or signature material, and the whitelist lookup is a simple ETS member check without comparing the full certificate. The trust anchor list is empty, so the whitelisted certificate is not used for path validation. Consequently, an attacker who knows or can guess the issuer DN and serial number of a whitelisted certificate can bypass TLS client authentication by presenting a forged self-signed certificate. This vulnerability affects RabbitMQ versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 and requires the rabbitmq_trust_store plugin to be enabled and used as the TLS verify function.

An attacker who knows or can guess the issuer distinguished name and serial number of a whitelisted certificate can bypass TLS client authentication, potentially allowing unauthorized access to RabbitMQ services. This undermines the security of TLS client authentication when the trust-store plugin is enabled and used as the TLS verify function.

A fix is available in RabbitMQ versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. Users should upgrade to these or later versions to remediate the vulnerability. Ensure that the rabbitmq_trust_store plugin is updated accordingly. No other specific mitigations are indicated by the vendor advisory.