CVE-2026-67231
published 2026-09-23CVE-2026-67231: RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verify_fun that…
PriorityP261critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.23%
12.8th percentile
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verify_fun that overrides {bad_cert, unknown_ca} / {bad_cert, selfsigned_peer} when the presented cert "matches" a whitelisted one. The match key is extract_issuer_id/1 → public_key:pkix_issuer_id/2 → {IssuerName, SerialNumber} , both fields are taken verbatim from the presented certificate body and contain no public-key, SKI, fingerprint or signature material. is_whitelisted/1 is a pure ets:member lookup; the stored full DER is used only for list/0 display and is never compared against the presented cert. cacerts is [], so the whitelisted cert is never used as a trust anchor for path validation either. TLS client-authentication bypass: an attacker who knows the issuer DN + serial of any whitelisted certificate can connect with a forged self-signed cert. Preconditions include rabbitmq_trust_store plugin enabled and used as the TLS verify_fun Attacker knows or can guess the {Issuer, Serial} of at least one whitelisted cert (non-secret; exposed via CLI/logs/any cert copy). This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| broadcom | rabbitmq_server | >= 3.13.0 < 3.13.15 | 3.13.15 |
| broadcom | rabbitmq_server | >= 4.0.0 < 4.0.20 | 4.0.20 |
| broadcom | rabbitmq_server | >= 4.1.0 < 4.1.11 | 4.1.11 |
| broadcom | rabbitmq_server | >= 4.2.0 < 4.2.6 | 4.2.6 |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
| ubuntu | rabbitmq-server | — | — |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
nvdv4.09.1CRITICALCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat9.1CRITICAL
vendor_ubuntu7.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
RabbitMQ up to 3.13.14/4.0.19/4.1.10/4.2.5 trust-store plugin extract_issuer_id certificate validation
vuldb·2026-09-23·CVSS 9.1
CVE-2026-67231 [CRITICAL] RabbitMQ up to 3.13.14/4.0.19/4.1.10/4.2.5 trust-store plugin extract_issuer_id certificate validation
A vulnerability was found in RabbitMQ up to 3.13.14/4.0.19/4.1.10/4.2.5. It has been classified as problematic. The affected element is the function extract_issuer_id of the component trust-store plugin. Performing a manipulation results in improper certificate validation.
This vulnerability is cataloged as CVE-2026-67231. It is possible to initiate the attack remotely. There is no exploit available.
Upgrading the affected component is recommended.
Ubuntu
RabbitMQ Server vulnerabilities
vendor_ubuntu·2026-10-15·CVSS 7.6
CVE-2026-67404 [HIGH] RabbitMQ Server vulnerabilities
Title: RabbitMQ Server vulnerabilities
Summary: Several security issues were fixed in RabbitMQ Server.
It was discovered that RabbitMQ Server incorrectly handled CORS wildcard
origin configuration. An attacker could possibly use this issue to cause
a cross-site request forgery attack. This issue only affected Ubuntu 18.04
LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04
LTS. (CVE-2026-66070)
It was discovered that RabbitMQ Server incorrectly handled TLS
peer-certificate DNs in the management UI. An attacker could possibly use
this issue to cause a cross-site scripting attack. (CVE-2026-66077)
It was discovered that RabbitMQ Server incorrectly handled AMQP 1.0 arrays
with zero-width element constructors. An attacker could possibly use this
issue to cause a den
Red Hat
rabbitmq: rabbitmq-server: RabbitMQ: Trust-store whitelist by Issuer+Serial only
vendor_redhat·2026-09-23·CVSS 9.1
CVE-2026-67231 [CRITICAL] CWE-295 rabbitmq: rabbitmq-server: RabbitMQ: Trust-store whitelist by Issuer+Serial only
rabbitmq: rabbitmq-server: RabbitMQ: Trust-store whitelist by Issuer+Serial only
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verify_fun that overrides {bad_cert, unknown_ca} / {bad_cert, selfsigned_peer} when the presented cert "matches" a whitelisted one. The match key is extract_issuer_id/1 → public_key:pkix_issuer_id/2 → {IssuerName, SerialNumber} , both fields are taken verbatim from the presented certificate body and contain no public-key, SKI, fingerprint or signature material. is_whitelisted/1 is a pure ets:member lookup; the stored full DER is used only for list/0 display and is never compared against the presented cert. cacerts is [], so the whitelisted cert is never used as a trust a
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-67231 rabbitmq-server: RabbitMQ: Trust-store whitelist by Issuer+Serial only [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-67231 [CRITICAL] CVE-2026-67231 rabbitmq-server: RabbitMQ: Trust-store whitelist by Issuer+Serial only [fedora-all]
CVE-2026-67231 rabbitmq-server: RabbitMQ: Trust-store whitelist by Issuer+Serial only [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verify_fun that overrides {bad_cert, unknown_ca} / {bad_cert, selfsigned_peer} when the presented cert "matches" a whitelisted one. The match key is extract_issuer_id/1 → public_key:pkix_issuer_id/2 → {IssuerName, SerialNumber} , both fields are taken verbatim from the presented certificate body and contain no public-key, SKI, finge
Bugzilla
CVE-2026-67231 rabbitmq: rabbitmq-server: RabbitMQ: Trust-store whitelist by Issuer+Serial only
bugzilla·2026-09-23·CVSS 9.1
CVE-2026-67231 [CRITICAL] CVE-2026-67231 rabbitmq: rabbitmq-server: RabbitMQ: Trust-store whitelist by Issuer+Serial only
CVE-2026-67231 rabbitmq: rabbitmq-server: RabbitMQ: Trust-store whitelist by Issuer+Serial only
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verify_fun that overrides {bad_cert, unknown_ca} / {bad_cert, selfsigned_peer} when the presented cert "matches" a whitelisted one. The match key is extract_issuer_id/1 → public_key:pkix_issuer_id/2 → {IssuerName, SerialNumber} , both fields are taken verbatim from the presented certificate body and contain no public-key, SKI, fingerprint or signature material. is_whitelisted/1 is a pure ets:member lookup; the stored full DER is used only for list/0 display and is never compared against the presented cert. cacerts is [], so the whitelisted cert is never us
2026-09-23
Published