---
id: CVE-2026-67223
title: RabbitMQ is a messaging and streaming broker
summary: >-
  RabbitMQ is a messaging and streaming broker. The advisory establishes
  affected 3.13, 4.0, 4.1, 4.2, and 4.3 maintenance lines but contains
  conflicting first-fixed versions for the 3.13, 4.0, and 4.1 lines. fill/2
  substitutes ${username}…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'
cwe:
  - CWE-90
vendor: broadcom
product: rabbitmq_server
affected:
  - 'rabbitmq_server >= 3.13.0, < 3.13.18'
  - 'rabbitmq_server >= 4.0.0, < 4.0.23'
  - 'rabbitmq_server >= 4.1.0, < 4.1.14'
  - 'rabbitmq_server >= 4.2.0, < 4.2.9'
  - 'rabbitmq_server >= 4.3.0, < 4.3.3'
patched:
  - rabbitmq_server 4.3.3
published: '2026-09-25'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T19:54:50.830'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67223'
references:
  - url: >-
      https://github.com/rabbitmq/rabbitmq-server/commit/ad3ca47accd313a4a0dbcbbe17bf60fc8f4b2614
    label: security-advisories@github.com
  - url: >-
      https://github.com/rabbitmq/rabbitmq-server/commit/b54056e59b7fd3a2d7f07dfaba95f026e138eee8
    label: security-advisories@github.com
  - url: 'https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9'
    label: security-advisories@github.com
  - url: 'https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3'
    label: security-advisories@github.com
  - url: >-
      https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-9x7r-g78c-5835
    label: security-advisories@github.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67223.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-67223'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2541511'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-67223'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67223'
  - url: 'https://access.redhat.com/errata/RHSA-2026:67552'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00357
epssPercentile: 0.29254
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-25T17:50:52.557104Z'
scores:
  nvd: 7.1
  cna: 6.3
  vendor: 4.8
ingestedAt: '2026-09-25T17:13:14.027Z'
---

## Overview

RabbitMQ is a messaging and streaming broker. The advisory establishes affected 3.13, 4.0, 4.1, 4.2, and 4.3 maintenance lines but contains conflicting first-fixed versions for the 3.13, 4.0, and 4.1 lines. fill/2 substitutes ${username} into user_dn_pattern without RFC 4514 DN escaping, allowing a crafted username to alter the LDAP bind DN and potentially select a different directory entry. Exploitation requires rabbitmq_auth_backend_ldap with a user_dn_pattern containing ${username}, a directory layout in which the injected suffix resolves usefully, and a password valid for the resulting DN. The advisory body identifies 3.13.15, 4.0.20, 4.1.11, 4.2.9, and 4.3.3 as fixed, while structured metadata identifies 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3. No fixed-version assertion is certifiable until a curator resolves this conflict.

## Affected

- `rabbitmq_server >= 3.13.0, < 3.13.18`
- `rabbitmq_server >= 4.0.0, < 4.0.23`
- `rabbitmq_server >= 4.1.0, < 4.1.14`
- `rabbitmq_server >= 4.2.0, < 4.2.9`
- `rabbitmq_server >= 4.3.0, < 4.3.3`

## Remediation

Upgrade past the affected range:

- `rabbitmq_server 4.3.3`

## Vendor advisories

- **RHSA-2026:67552** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67552)
- **Red Hat VEX** · Moderate · affected: Red Hat Hardened Images, Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0 · no fix planned: Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat Hardened Images, … · updated 2026-10-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67223.json)