CVE-2026-67223 rabbitmq CVE debrief

Who should care

RabbitMQ administrators and security teams should assess exposure, especially those using rabbitmq_auth_backend_ldap with specific user_dn_pattern configurations. Additional stakeholders include affected operators, platform administrators, vulnerability management teams, and security teams who need to verify and mitigate this vulnerability in their environments.

Why it matters

CVE-2026-67223 is a medium-severity vulnerability in RabbitMQ that allows LDAP injection due to insufficient DN escaping. Defenders should verify exposure, especially in deployments using rabbitmq_auth_backend_ldap with specific configurations, and prioritize monitoring and potential version updates.

• Potential unauthorized directory entry selection
• Possible authentication bypass
• Required verification of RabbitMQ versions and configurations
• Necessity to monitor for crafted usernames

Technical summary

The rabbitmq_auth_backend_ldap plugin in RabbitMQ does not properly escape ${username} in user_dn_pattern, allowing LDAP injection. A crafted username can modify the LDAP bind DN, potentially selecting a different directory entry. This requires specific conditions: rabbitmq_auth_backend_ldap in use, a user_dn_pattern containing ${username}, a useful directory layout, and a valid password for the resulting DN.

Defensive priority

Defenders should prioritize verifying exposure in RabbitMQ deployments using rabbitmq_auth_backend_ldap, especially those with user_dn_pattern containing ${username}.

Recommended defensive actions

• Verify RabbitMQ version and maintenance line against advisory information
• Check if rabbitmq_auth_backend_ldap is in use and if user_dn_pattern contains ${username}
• Assess directory layout for potential injected suffix resolution
• Validate passwords for resulting DNs
• Monitor for crafted usernames attempting to alter LDAP bind DN

Evidence notes

The advisory body identifies 3.13.15, 4.0.20, 4.1.11, 4.2.9, and 4.3.3 as fixed, while structured metadata identifies 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3. However, the conflict in fixed versions needs resolution.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.