CVE-2026-67223
Description
A flaw was found in rabbitmq-server. When the service uses the Lightweight Directory Access Protocol (LDAP) authentication plugin with a configured user Distinguished Name (DN) pattern, it fails to properly escape special characters in the username. A remote attacker can exploit this vulnerability by submitting a specially crafted username during authentication to alter the directory lookup. This can allow an attacker to authenticate against an unintended directory account and gain unauthorized access.
Statement
This vulnerability is rated as Moderate severity because successful exploitation relies on a non-default authentication backend configuration and specific directory prerequisites. By default, Red Hat environments deploy RabbitMQ with internal user management rather than external LDAP authentication. Even when the LDAP authentication backend is explicitly enabled, the issue is only triggered if a user DN pattern is configured and an attacker has valid credentials corresponding to the targeted directory record.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.8 | 7.1 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | High | Low | N/A |
| Privileges Required | None | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | Low | High | N/A |
| Integrity Impact | Low | Low | N/A |
| Availability Impact | None | None | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
NVD: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
