CVE-2026-67223 is an LDAP injection in the RabbitMQ LDAP authentication plugin. The record scores it high (7.1) and the advisory rates it moderate (CVSS v4 6.3). The advisory gives two sets of fixed versions that disagree. The safe course is to move to the higher number on each line, or to 4.2.9 or 4.3.3 on the newest lines.
What's affected
The RabbitMQ advisory says the 3.13, 4.0, 4.1, 4.2 and 4.3 maintenance lines are affected. In each line, every release from the first one up to the fixed version is in scope. Only installs that enable rabbitmq_auth_backend_ldap with a user_dn_pattern that contains the username placeholder are exposed.
The fixed versions conflict inside the advisory itself:
- The advisory body says fixed in 3.13.15, 4.0.20, 4.1.11, 4.2.9 and 4.3.3.
- The advisory's structured metadata says patched in 3.13.18, 4.0.23, 4.1.14, 4.2.9 and 4.3.3.
Both lists agree on 4.2.9 and 4.3.3. For the three older lines they differ. The record itself states that no fixed version assertion can be certified until the conflict is resolved. I cannot resolve it either, so use the higher number for each line, which is guaranteed to include the fix if either list is right. The RabbitMQ 4.2.9 and 4.3.3 release notes both list "Additional DN escaping (RFC 4514) improvements" under the LDAP plugin.
Severity also differs. The record gives 7.1 (High). The advisory gives CVSS v4 6.3 (Moderate). The weakness is CWE-90.
How to check if you're exposed
Check the version, whether the plugin is on, and how the DN pattern is set:
rabbitmqctl version
rabbitmq-plugins list -e rabbitmq_auth_backend_ldap
grep -r user_dn_pattern /etc/rabbitmq/
You are in the exposed group only if the plugin is enabled and the pattern puts the username directly into the DN. The advisory lists two more preconditions: a directory layout where the injected suffix resolves to a useful entry, and a password that is valid for the resulting DN.
What to do now
- Find every RabbitMQ node and record its version and whether the LDAP plugin is enabled.
- Upgrade to the higher fixed version on your line, which is 3.13.18, 4.0.23, 4.1.14, 4.2.9 or 4.3.3.
- If you cannot upgrade yet, review your user_dn_pattern and your directory layout for places where a crafted username could land in a different branch.
- Review which usernames your directory accepts, and whether odd characters in names are rejected.
- Check your directory's rules on anonymous or empty password binds.
Why it matters
The plugin builds a distinguished name by substituting the username into a template. If the substitution does not escape the characters that carry meaning in a DN, a username can add its own components. The advisory gives the effect as a shift of the bind DN into a different organizational unit, which could match a different entry.
The attack is narrow, which is why the advisory is moderate. The attacker also needs a password that works for the resulting entry. The advisory says its verifier refuted the original LDAP filter injection claim, because the search filters are built structurally. Only the DN suffix problem remains.
No source I reviewed says this CVE is exploited in the wild, and the record's KEV flag is false.
Quick check
Which version should I install?
The advisory lists two sets of fixed versions that disagree for the older lines. Use the higher number for your line, or 4.2.9 or 4.3.3.
Am I affected if I do not use LDAP?
No. The advisory requires the LDAP authentication plugin with a DN pattern that contains the username.
Sources
Last reviewed: 18 October 2026.
