LDAP Injection Vulnerability in RabbitMQ Messaging Broker
CVE-2026-67223
What is CVE-2026-67223?
An LDAP injection flaw exists in RabbitMQ that allows user-supplied data to compromise the LDAP bind DN. Specifically, the vulnerability arises because the 'fill/2' function substitutes a crafted username into the 'user_dn_pattern' without performing necessary RFC 4514 DN escaping. If successfully exploited, this could enable an attacker to manipulate the LDAP bind DN and select an unintended directory entry. The conditions for exploitation include the usage of the rabbitmq_auth_backend_ldap authentication plugin with a user_dn_pattern that contains '${username}', a conducive directory layout, and a valid password for the resultant DN. Conflicting information exists regarding the first fixed versions in certain maintenance lines, requiring further clarification from the advisory body.
Affected Version(s)
rabbitmq-server >= 3.13.0, < 3.13.18 < 3.13.0, 3.13.18
rabbitmq-server >= 4.0.0, < 4.0.23 < 4.0.0, 4.0.23
rabbitmq-server >= 4.1.0, < 4.1.14 < 4.1.0, 4.1.14