CVE-2026-67231: RabbitMQ Trust-Store Plugin TLS Client-Auth Bypass

CVE-2026-67231 is a TLS client-authentication bypass in RabbitMQ's trust-store plugin, where the certificate-matching logic only compares an incoming certificate's issuer distinguished name and serial number — both plaintext fields copied verbatim from the presented certificate itself, never checked against an actual trust anchor — so an attacker who learns the issuer/serial of any whitelisted certificate can connect with a forged self-signed certificate as if it were trusted.

CVE-2026-67231 (CWE-295, Improper Certificate Validation) affects RabbitMQ, the widely-deployed open-source messaging and streaming broker used across enterprise integration, microservices and industrial data-pipeline architectures, specifically its rabbitmq_trust_store plugin, which lets operators whitelist individual TLS client certificates for mutual-TLS authentication instead of running full certificate-authority validation. NVD's description explains the match key is extract_issuer_id/1 -> public_key:pkix_issuer_id/2 -> {IssuerName, SerialNumber}, and that "both fields are taken verbatim from the presented certificate body and contain no public-key, SKI, fingerprint or signature material"; is_whitelisted/1 performs a bare ETS table lookup against that pair, and because the plugin's cacerts list is empty, the whitelisted certificate is never used as an actual trust anchor for path validation. NVD concludes: "an attacker who knows the issuer DN + serial of any whitelisted certificate can connect with a forged self-signed cert" (NVD).

NVD assigns a Primary CVSS v3.1 base score of 9.1 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N — network-reachable, low complexity, no privileges or interaction, full confidentiality and integrity impact. GitHub's own CNA submission scores the same issue under CVSS v4.0 at 9.1 as well, vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N — the AT:P (attack requirements present) term reflects that the attacker must first learn a whitelisted certificate's issuer and serial, which NVD's own text notes is "non-secret; exposed via CLI/logs/any cert copy" (NVD CVE record).

The RabbitMQ Server GitHub Security Advisory GHSA-cw8c-4m83-9c6w, titled "Trust-store whitelist by Issuer+Serial only," confirms the affected range (rabbitmq-server >=3.13.0 <3.13.15, >=4.0.0 <4.0.20, >=4.1.0 <4.1.11, >=4.2.0 <4.2.6), the patched versions (3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.0), and attributes discovery to "Team RabbitMQ and other Broadcom teams" as an internal finding rather than external disclosure (GitHub Security Advisory GHSA-cw8c-4m83-9c6w).

The precondition for exploitation is that an operator has rabbitmq_trust_store enabled and configured as the TLS verify_fun for client authentication — a deployment pattern used specifically to avoid running a full CA hierarchy for client certs — so the practical blast radius is scoped to RabbitMQ deployments that rely on this plugin rather than every RabbitMQ installation.

As of 2026-10-30, FIRST scores the probability of exploitation at 0.00228 (13.59th percentile) (FIRST EPSS). CVE-2026-67231 is not currently listed in the CISA Known Exploited Vulnerabilities catalog (checked against the live KEV feed, catalog version 2026.10.30, 1766 entries).

Operators using the rabbitmq_trust_store plugin for TLS client authentication should upgrade to 3.13.15, 4.0.20, 4.1.11, 4.2.6 or 4.3.0 as appropriate for their release line.

• RabbitMQ's rabbitmq_trust_store plugin matches client certificates only by issuer name and serial number (both taken verbatim from the presented certificate, with an empty trust-anchor list), allowing an attacker who knows a whitelisted certificate's issuer/serial to connect with a forged self-signed certificate; affects versions before 3.13.15, 4.0.20, 4.1.11, 4.2.6 and 4.3.0. — NVD
• NVD Primary CVSS v3.1 base score is 9.1 critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N); GitHub's own CNA submission scores it under CVSS v4.0 at 9.1 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N). — NVD
• GitHub Security Advisory GHSA-cw8c-4m83-9c6w confirms the affected version ranges, the patched versions (3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.0), and attributes discovery to Team RabbitMQ and other Broadcom teams internally. — GitHub Security Advisory
• EPSS score is 0.00228 (13.59th percentile) as of 2026-10-30; not present in the live CISA KEV feed (catalog version 2026.10.30, 1766 entries) checked by exact cveID match. — FIRST EPSS