LDAP injection in RabbitMQ Server - CVE-2026-67223
Published: July 24, 2026 / Updated: September 28, 2026
Vulnerability details
The vulnerability allows a remote attacker to modify integrity of LDAP-based authentication decisions.
The vulnerability exists due to improper neutralization of special elements used in an LDAP query in the fill/2 function of rabbit_auth_backend_ldap_util.erl when interpolating the username into a DN string for LDAP simple-bind. A remote attacker can supply a specially crafted username containing unescaped DN special characters to modify integrity of LDAP-based authentication decisions.
Only deployments with rabbitmq_auth_backend_ldap enabled and a user_dn_pattern containing ${username} are vulnerable. Exploitation also requires a directory layout where DN-suffix injection resolves to a useful entry.