CVE-2026-67231

Received Received - Intake

TLS Client-Authentication Bypass in RabbitMQ Trust-Store Plugin

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verify_fun that overrides {bad_cert, unknown_ca} / {bad_cert, selfsigned_peer} when the presented cert "matches" a whitelisted one. The match key is extract_issuer_id/1 → public_key:pkix_issuer_id/2 → {IssuerName, SerialNumber} , both fields are taken verbatim from the presented certificate body and contain no public-key, SKI, fingerprint or signature material. is_whitelisted/1 is a pure ets:member lookup; the stored full DER is used only for list/0 display and is never compared against the presented cert. cacerts is [], so the whitelisted cert is never used as a trust anchor for path validation either. TLS client-authentication bypass: an attacker who knows the issuer DN + serial of any whitelisted certificate can connect with a forged self-signed cert. Preconditions include rabbitmq_trust_store plugin enabled and used as the TLS verify_fun Attacker knows or can guess the {Issuer, Serial} of at least one whitelisted cert (non-secret; exposed via CLI/logs/any cert copy). This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-23

Generated

2026-09-24

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-67231

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq	to 3.13.15 (exc)
rabbitmq	rabbitmq	to 4.0.20 (exc)
rabbitmq	rabbitmq	to 4.1.11 (exc)
rabbitmq	rabbitmq	to 4.2.6 (exc)
rabbitmq	rabbitmq	to 4.3.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

Executive Summary

This vulnerability in RabbitMQ's trust-store plugin allows an attacker to bypass TLS client authentication. The plugin incorrectly overrides certificate validation for certain cases when a certificate matches a whitelisted one. The match is based solely on issuer name and serial number extracted from the certificate, which are not unique identifiers. An attacker who knows these details can present a forged self-signed certificate to gain unauthorized access.

Impact Analysis

If you use RabbitMQ with the trust-store plugin enabled, an attacker could impersonate legitimate users or services to access sensitive data or perform unauthorized actions. This could lead to data breaches, service disruption, or unauthorized system access. The vulnerability requires the attacker to know the issuer and serial number of a whitelisted certificate.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strong authentication and secure communication channels. GDPR requires appropriate technical measures to ensure data security, while HIPAA mandates secure access controls. A bypass of TLS client authentication could result in unauthorized data access, potentially leading to non-compliance with these regulations.

Mitigation Strategies

Upgrade RabbitMQ to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.0 or later to address the TLS client-authentication bypass issue in the trust-store plugin.

Hi! I’m here to help you understand CVE-2026-67231. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70