Skip to main content

RabbitMQ EUVDEUVD-2026-85664

| CVE-2026-67231 CRITICAL
Improper Certificate Validation (CWE-295)
2026-09-23 GitHub_M
Authentication Bypass Red Hat Rabbitmq Server Suse Erlang Rabbitmq
9.1
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
9.1 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.1 CRITICAL

Network-reachable mTLS bypass with no privileges or interaction; issuer/serial is non-secret so AC:L; forged client gains full read/write to the messaging plane (C:H/I:H), no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat
8.1 HIGH
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

5
POC Analysis Generated
Sep 23, 2026 - 23:20 vuln.today
Patch available
Sep 23, 2026 - 22:18 EUVD
Metadata Corrected
Sep 23, 2026 - 21:40 vuln.today
tag: Erlang added
Analysis Generated
Sep 23, 2026 - 21:37 vuln.today
CVE Published
Sep 23, 2026 - 20:47 cve.org
CRITICAL 9.1

DescriptionCVE.org

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verify_fun that overrides {bad_cert, unknown_ca} / {bad_cert, selfsigned_peer} when the presented cert "matches" a whitelisted one. The match key is extract_issuer_id/1 → public_key:pkix_issuer_id/2 → {IssuerName, SerialNumber} , both fields are taken verbatim from the presented certificate body and contain no public-key, SKI, fingerprint or signature material. is_whitelisted/1 is a pure ets:member lookup; the stored full DER is used only for list/0 display and is never compared against the presented cert. cacerts is [], so the whitelisted cert is never used as a trust anchor for path validation either. TLS client-authentication bypass: an attacker who knows the issuer DN + serial of any whitelisted certificate can connect with a forged self-signed cert. Preconditions include rabbitmq_trust_store plugin enabled and used as the TLS verify_fun Attacker knows or can guess the {Issuer, Serial} of at least one whitelisted cert (non-secret; exposed via CLI/logs/any cert copy). This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

AnalysisAI

TLS client-authentication bypass in the RabbitMQ trust-store plugin lets a remote unauthenticated attacker whose forged self-signed certificate carries the issuer DN and serial number of any whitelisted certificate pass mutual-TLS authentication. Only deployments that have the rabbitmq_trust_store plugin enabled and wired in as the TLS verify_fun for a client-certificate listener are affected, and an attacker must first learn or guess at least one whitelisted certificate's {Issuer, Serial} pair, which is non-secret and is exposed by the plugin's list command, logs, or any copy of the certificate. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the rabbitmq_trust_store plugin to be enabled AND configured as the TLS verify_fun for a mutual-TLS (client-certificate) listener - this is not RabbitMQ's default configuration. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine TLS client-authentication bypass (CWE-295), not a high-CVSS-but-low-impact issue, but its real-world reach is gated by non-default configuration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Vendor-released patch: upgrade to RabbitMQ 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.0 depending on your release series, per the advisory at https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-cw8c-4m83-9c6w; the problem is fixed by changing the whitelist comparison so that real certificate material is verified rather than the issuer DN and serial number. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory every RabbitMQ deployment and determine which brokers have the rabbitmq_trust_store plugin enabled and wired in as the TLS verify_fun for a client-certificate listener, since those are the only systems at risk; for any that qualify, restrict network reachability to those TLS listeners to known client networks via firewall or security-group rules and review broker logs for unexpected client-certificate authentications. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Rabbitmq Server

View all
CVE-2026-57219 HIGH POC
8.7 Jul 10

Sensitive credential disclosure in RabbitMQ affects installations running the management plugin with OAuth 2 configured

CVE-2019-11287 HIGH POC
7.5 Nov 23

Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x ver
CVE-2016-9877 CRITICAL
9.8 Dec 29

An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.
CVE-2025-50200 MEDIUM POC
5.5 Jun 19

RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in
CVE-2026-67404 CRITICAL
9.2 Sep 23

RabbitMQ brokers that use the OAuth2 plugin can silently fall back to disabled TLS certificate verification when no CA b
CVE-2026-67409 HIGH
8.2 Sep 25

Authentication denial of service in RabbitMQ affects deployments running the rabbitmq_auth_backend_oauth2 plugin from 3.
CVE-2026-67410 HIGH
8.2 Sep 25

OAuth2 client secret disclosure in the RabbitMQ Management UI affects versions 4.2.0 through 4.2.8 and 4.3.0 through 4.3
CVE-2026-67232 HIGH
8.2 Sep 23

Memory-exhaustion denial of service in RabbitMQ's Web-MQTT plugin (rabbitmq_web_mqtt) lets an unauthenticated remote att
CVE-2026-67236 HIGH
8.2 Sep 25

The RabbitMQ management plugin in versions 4.2.0 through 4.2.8 and 4.3.0 through 4.3.2 writes an 'auth' cookie containin
CVE-2017-4966 HIGH
7.8 Jun 13

An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions p
CVE-2021-22117 HIGH
7.8 May 18

RabbitMQ installers on Windows prior to version 3.8.16 do not harden plugin directory permissions, potentially allowing

CVE-2026-67239 HIGH
7.6 Sep 25

Stored cross-site scripting (XSS) in the RabbitMQ stream management UI allows an attacker who can present a trusted TLS

Same weakness CWE-295 – Improper Certificate Validation

View all
CVE-2026-85102 CRITICAL POC
9.8
CVE-2015-3152 MEDIUM POC
5.9
CVE-2017-2800 CRITICAL POC
9.8
CVE-2014-1266 HIGH POC
7.4
CVE-2022-47758 CRITICAL POC
9.8
CVE-2025-68121 CRITICAL POC
10.0
CVE-2025-29331 CRITICAL POC
9.8
CVE-2025-32878 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected

Share

EUVD-2026-85664 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy