The RabbitMQ trust-store plugin incorrectly uses only the issuer DN and serial number from a client certificate to determine trust, ignoring the public key, SKI, or fingerprint. An attacker who can learn or guess a whitelisted certificate’s issuer and serial – information exposed through logs or CLI – can forge a self‑signed certificate that satisfies the whitelist check. This allows the attacker to successfully perform TLS client authentication as if they possessed a trusted certificate, potentially gaining access to RabbitMQ services and any resources protected by that authentication.

All RabbitMQ Server installations running versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.0 have the vulnerability when the rabbitmq_trust_store plugin is enabled and used as the TLS verify_fun.

The CVSS score of 9.1 indicates critical severity. Exploitation does not require any special privileges on the server; the attacker only needs network connectivity to the RabbitMQ broker and the ability to guess a legitimate issuer/serial pair, which is often publicly available. Because the vulnerability directly bypasses client authentication, a remote adversary can gain connected client privileges. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, but the high CVSS and the readily gleaned attacker inputs make exploitation likely in a realistic threat environment.