CVE-2026-67223

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.18 RabbitMQ versions prior to 4.0.23 RabbitMQ versions prior to 4.1.14 RabbitMQ versions prior to 4.2.9 RabbitMQ versions prior to 4.3.3

Description An issue exists where the fill/2 function substitutes the ${username} variable into the user dn pattern without proper RFC 4514 Distinguished Name (DN) escaping. This allows a crafted username to alter the LDAP bind DN, potentially enabling the selection of a different directory entry. Successful exploitation requires the use of rabbitmq auth backend ldap with a user dn pattern containing ${username}, a directory layout where the injected suffix resolves effectively, and a password valid for the resulting DN.

Recommendations Update to version 3.13.18 or later. Update to version 4.0.23 or later. Update to version 4.1.14 or later. Update to version 4.2.9 or later. Update to version 4.3.3 or later.