CVE-2026-44838
published 2026-05-27CVE-2026-44838: RabbitMQ is a messaging and streaming broker. From 4.2.0 to before 4.2.4, RabbitMQ's MQTT plugin allows for topic-level authorization using regular expressions…
PriorityP353high8.1CVSS 3.1
AVNACLPRLUINSUCHIHAN
EPSS
0.20%
9.7th percentile
RabbitMQ is a messaging and streaming broker. From 4.2.0 to before 4.2.4, RabbitMQ's MQTT plugin allows for topic-level authorization using regular expressions with variable substitution. Administrators can create patterns such as ^{client_id}-sensors$ to restrict user access to topics that include their client ID. However, the client_id is provided by the user in the MQTT CONNECT packet and is inserted into the regex pattern without escaping special regex characters. This flaw enables an authenticated MQTT user to inject regex operators to bypass authorization. This vulnerability is fixed in 4.2.4 and 4.3.0.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| broadcom | rabbitmq_server | >= 4.0.0 < 4.0.23 | 4.0.23 |
| broadcom | rabbitmq_server | >= 4.1.0 < 4.1.14 | 4.1.14 |
| broadcom | rabbitmq_server | >= 4.2.0 < 4.2.9 | 4.2.9 |
| broadcom | rabbitmq_server | >= 4.2.0 < 4.2.4 | 4.2.4 |
| broadcom | rabbitmq_server | >= 4.3.0 < 4.3.3 | 4.3.3 |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
rabbitmq-server: rabbitmq-server: MQTT topic permission bypass via improper regex escaping
vendor_redhat·2026-09-25·CVSS 8.1
CVE-2026-67407 [HIGH] CWE-184 rabbitmq-server: rabbitmq-server: MQTT topic permission bypass via improper regex escaping
rabbitmq-server: rabbitmq-server: MQTT topic permission bypass via improper regex escaping
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3 and 4.2.9 and 4.1.14 and 4.0.23, Incomplete fix for CVE-2026-44838: escaperegexchar/1 does not escape -, leaving room for an MQTT topic permission bypass. the CVE-2026-44838 fix made expandtopicpermission/2 escape regex metacharacters in expanded topic-permission variables (escaperegex(V)), but escaperegexchar/1 escapes \ ^ $ . | ? + ( ) [ ] { } and omits -. When a topic permission template places {clientid} inside a [...] character class A low-privileged authenticated MQTT user controlling its clientid can broaden topic authorization (read and write) when templates embed {clientid} in a [...] This issue is fixed in versions 4.3.3
Red Hat
rabbitmq-server: RabbitMQ: Authorization bypass via regular expression injection in MQTT client ID
vendor_redhat·2026-05-27·CVSS 8.1
CVE-2026-44838 [HIGH] CWE-624 rabbitmq-server: RabbitMQ: Authorization bypass via regular expression injection in MQTT client ID
rabbitmq-server: RabbitMQ: Authorization bypass via regular expression injection in MQTT client ID
RabbitMQ is a messaging and streaming broker. From 4.2.0 to before 4.2.4, RabbitMQ's MQTT plugin allows for topic-level authorization using regular expressions with variable substitution. Administrators can create patterns such as ^{client_id}-sensors$ to restrict user access to topics that include their client ID. However, the client_id is provided by the user in the MQTT CONNECT packet and is inserted into the regex pattern without escaping special regex characters. This flaw enables an authenticated MQTT user to inject regex operators to bypass authorization. This vulnerability is fixed in 4.2.4 and 4.3.0.
A flaw was found in RabbitMQ. An authenticated MQTT (Message Queuing Telemetry Tra
VulDB
RabbitMQ rabbitmq-server up to 4.2.3 Regular Expression authorization (GHSA-x866-xp2g-cx8v / Nessus ID 317941)
vuldb·2026-06-07·CVSS 8.1
CVE-2026-44838 [HIGH] RabbitMQ rabbitmq-server up to 4.2.3 Regular Expression authorization (GHSA-x866-xp2g-cx8v / Nessus ID 317941)
A vulnerability identified as critical has been detected in RabbitMQ rabbitmq-server up to 4.2.3. This issue affects some unknown processing of the component Regular Expression Handler. This manipulation causes incorrect authorization.
This vulnerability appears as CVE-2026-44838. The attack may be initiated remotely. There is no available exploit.
You should upgrade the affected component.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-67407 rabbitmq-server: rabbitmq-server: MQTT topic permission bypass via improper regex escaping
bugzilla·2026-09-25·CVSS 8.1
CVE-2026-67407 [HIGH] CVE-2026-67407 rabbitmq-server: rabbitmq-server: MQTT topic permission bypass via improper regex escaping
CVE-2026-67407 rabbitmq-server: rabbitmq-server: MQTT topic permission bypass via improper regex escaping
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3 and 4.2.9 and 4.1.14 and 4.0.23, Incomplete fix for CVE-2026-44838: escaperegexchar/1 does not escape -, leaving room for an MQTT topic permission bypass. the CVE-2026-44838 fix made expandtopicpermission/2 escape regex metacharacters in expanded topic-permission variables (escaperegex(V)), but escaperegexchar/1 escapes \ ^ $ . | ? + ( ) [ ] { } and omits -. When a topic permission template places {clientid} inside a [...] character class A low-privileged authenticated MQTT user controlling its clientid can broaden topic authorization (read and write) when templates embed {clientid} in a [...] This issue is fixed in
Bugzilla
CVE-2026-44838 rabbitmq-server: RabbitMQ: Authorization bypass via regular expression injection in MQTT client ID
bugzilla·2026-05-27·CVSS 8.1
CVE-2026-44838 [HIGH] CVE-2026-44838 rabbitmq-server: RabbitMQ: Authorization bypass via regular expression injection in MQTT client ID
CVE-2026-44838 rabbitmq-server: RabbitMQ: Authorization bypass via regular expression injection in MQTT client ID
RabbitMQ is a messaging and streaming broker. From 4.2.0 to before 4.2.4, RabbitMQ's MQTT plugin allows for topic-level authorization using regular expressions with variable substitution. Administrators can create patterns such as ^{client_id}-sensors$ to restrict user access to topics that include their client ID. However, the client_id is provided by the user in the MQTT CONNECT packet and is inserted into the regex pattern without escaping special regex characters. This flaw enables an authenticated MQTT user to inject regex operators to bypass authorization. This vulnerability is fixed in 4.2.4 and 4.3.0.
2026-05-27
Published