---
id: CVE-2026-67223
title: RabbitMQ is a messaging and streaming broker
summary: >-
  RabbitMQ is a messaging and streaming broker. The advisory establishes
  affected 3.13, 4.0, 4.1, 4.2, and 4.3 maintenance lines but contains
  conflicting first-fixed versions for the 3.13, 4.0, and 4.1 lines. fill/2
  substitutes ${username}…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-90
vendor: rabbitmq
product: rabbitmq-server
affected:
  - 'rabbitmq-server >= 3.13.0, < 3.13.18'
  - 'rabbitmq-server >= 4.0.0, < 4.0.23'
  - 'rabbitmq-server >= 4.1.0, < 4.1.14'
  - 'rabbitmq-server >= 4.2.0, < 4.2.9'
  - 'rabbitmq-server >= 4.3.0, < 4.3.3'
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T18:17:29.517'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67223'
references:
  - url: >-
      https://github.com/rabbitmq/rabbitmq-server/commit/ad3ca47accd313a4a0dbcbbe17bf60fc8f4b2614
    label: security-advisories@github.com
  - url: >-
      https://github.com/rabbitmq/rabbitmq-server/commit/b54056e59b7fd3a2d7f07dfaba95f026e138eee8
    label: security-advisories@github.com
  - url: 'https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9'
    label: security-advisories@github.com
  - url: 'https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3'
    label: security-advisories@github.com
  - url: >-
      https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-9x7r-g78c-5835
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-25T17:50:52.557104Z'
cvssSource: cna
ingestedAt: '2026-09-25T17:13:14.027Z'
---

## Overview

RabbitMQ is a messaging and streaming broker. The advisory establishes affected 3.13, 4.0, 4.1, 4.2, and 4.3 maintenance lines but contains conflicting first-fixed versions for the 3.13, 4.0, and 4.1 lines. fill/2 substitutes ${username} into user_dn_pattern without RFC 4514 DN escaping, allowing a crafted username to alter the LDAP bind DN and potentially select a different directory entry. Exploitation requires rabbitmq_auth_backend_ldap with a user_dn_pattern containing ${username}, a directory layout in which the injected suffix resolves usefully, and a password valid for the resulting DN. The advisory body identifies 3.13.15, 4.0.20, 4.1.11, 4.2.9, and 4.3.3 as fixed, while structured metadata identifies 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3. No fixed-version assertion is certifiable until a curator resolves this conflict.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.