The vulnerability is an LDAP injection flaw in RabbitMQ server where the fill/2 function substitutes an unescaped ${username} into the LDAP user_dn_pattern. This allows an attacker to craft a username that manipulates the LDAP bind DN so that the broker attempts to bind as an arbitrary directory entry. If the attacker also supplies a password that is valid for the injected DN, they can authenticate as that entry, potentially gaining unauthorized access or impersonation. The weakness arises from improper input validation of LDAP Distinguished Names (CWE‑90).

Vendors affected: RabbitMQ (rabbitmq-server). Maintenance lines affected include 3.13, 4.0, 4.1, 4.2, and 4.3. Version numbers prior to the following fixed releases are vulnerable: 3.13.x before 3.13.15 or 3.13.18, 4.0.x before 4.0.20 or 4.0.23, 4.1.x before 4.1.11 or 4.1.14, 4.2.x before 4.2.9, and 4.3.x before 4.3.3. The advisory lists 4.2.9 and 4.3.3 as the definitive fixes, but a conflict exists for the earlier lines, so use those specific releases or newer.

The CVSS score of 6.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widely known exploit activity. The attack vector requires that RabbitMQ is configured to use the rabbitmq_auth_backend_ldap plugin with a user_dn_pattern that includes ${username}. Given that the attacker must also provide a valid LDAP password and that the injected suffix must resolve to an entry in the directory, the exploitation requires a specific environment and configuration, which reduces the likelihood of random exploitation but still presents a risk in environments that meet the prerequisites.