Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-67223

RabbitMQ is a messaging and streaming broker

Risk score
48/100
CVSS
7.1 v3.1
Exploit chance (30 days)
0.4%
Published
25 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
RabbitMQ is a messaging and streaming broker. The advisory establishes affected 3.13, 4.0, 4.1, 4.2, and 4.3 maintenance lines but contains conflicting first-fixed versions for the 3.13, 4.0, and 4.1 lines. fill/2 substitutes ${username} into user_dn_pattern without RFC 4514 DN escaping, allowing a crafted username to…
Affected
Broadcom Rabbitmq Server
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Broadcom Rabbitmq ServerTHE FLAWSTHE FIXCVE-2026-67223RabbitMQ is a messaging andstreaming brokerCVSS 7.1 · EPSS 0%CVE-2026-67237RabbitMQ is a messaging andstreaming brokerCVSS 9.3 · EPSS 0%CVE-2026-66070RabbitMQ is a messaging andstreaming brokerCVSS 8.8 · EPSS 0%CVE-2026-67231RabbitMQ is a messaging andstreaming brokerCVSS 9.1 · EPSS 0%Upgrade Broadcom Rabbitmq…4.2.8 · 4.3.2 · 3.13.17 · 4.0.22 ·4.1.13 · 4.2.6or later on your release lineWho is exposedBroadcom Rabbitmq Serverbefore 4.2.8, 4.3.2AMBER · PATCH THIS WEEKBroadcomRabbitmq ServerRabbitMQ is a messaging andstreaming broker. From 4.2.0until 4.2.8 and 4.3.2,set_token_auth/2 inserted abearer token from theAuthorization header oraccess_token cookie into OAuth…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-90 (CWE-90)5 other warnings in 30 days →Same productEarlier Broadcom Rabbitmq Server warnings45 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Broadcom Rabbitmq Server: Amber, patch this week. RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorization header or access_token cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token content to execute JavaScript in the management UI origin. T…

The flaws

  • CVE-2026-67223: RabbitMQ is a messaging and streaming broker (CVSS 7.1 · EPSS 0%)
  • CVE-2026-67237: RabbitMQ is a messaging and streaming broker (CVSS 9.3 · EPSS 0%)
  • CVE-2026-66070: RabbitMQ is a messaging and streaming broker (CVSS 8.8 · EPSS 0%)
  • CVE-2026-67231: RabbitMQ is a messaging and streaming broker (CVSS 9.1 · EPSS 0%)

The fix

Upgrade Broadcom Rabbitmq Server: 4.2.8 · 4.3.2 · 3.13.17 · 4.0.22 · 4.1.13 · 4.2.6 or later on your release line

Who is exposed: Broadcom Rabbitmq Server before 4.2.8, 4.3.2

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 7.1 high

References

Original description

RabbitMQ is a messaging and streaming broker. The advisory establishes affected 3.13, 4.0, 4.1, 4.2, and 4.3 maintenance lines but contains conflicting first-fixed versions for the 3.13, 4.0, and 4.1 lines. fill/2 substitutes ${username} into user_dn_pattern without RFC 4514 DN escaping, allowing a crafted username to alter the LDAP bind DN and potentially select a different directory entry. Exploitation requires rabbitmq_auth_backend_ldap with a user_dn_pattern containing ${username}, a directory layout in which the injected suffix resolves usefully, and a password valid for the resulting DN. The advisory body identifies 3.13.15, 4.0.20, 4.1.11, 4.2.9, and 4.3.3 as fixed, while structured metadata identifies 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3. No fixed-version assertion is certifiable until a curator resolves this conflict.

Last activity 25 Sep 2026. Patch Forecast updates every hour.