CVE-2026-67407: RabbitMQ: Incomplete fix for CVE-2026-44838: `escape_regex_char/1` does not escape `-`, leaving room for an MQTT topic permission bypass
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3 and 4.2.9 and 4.1.14 and 4.0.23, Incomplete fix for CVE-2026-44838: escaperegexchar/1 does not escape -, leaving room for an MQTT topic permission bypass. the CVE-2026-44838 fix made expandtopicpermission/2 escape regex metacharacters in expanded topic-permission variables (escaperegex(V)), but escaperegexchar/1 escapes \ ^ $ . | ? + ( ) [ ] { } and omits -. When a topic permission template places {clientid} inside a [...] character class A low-privileged authenticated MQTT user controlling its clientid can broaden topic authorization (read and write) when templates embed {clientid} in a [...] This issue is fixed in versions 4.3.3 and 4.2.9 and 4.1.14 and 4.0.23.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.3.3
Event History
Frequently Asked Questions
Which deployments are exposed to this authorization bypass?
RabbitMQ deployments running versions from 4.0.0 up to, but excluding, 4.0.23, 4.1.14, 4.2.9, or 4.3.3 are affected when MQTT topic-permission templates place {clientid} inside a [...] character class.
What does an attacker need to exploit this issue?
An attacker needs to be an authenticated MQTT user with low privileges and control over their client ID. Exploitation depends on a vulnerable topic-permission template embedding {clientid} in a character class, allowing the client ID to broaden read and write topic authorization.
How can I remediate the issue?
Upgrade to RabbitMQ 4.3.3, 4.2.9, 4.1.14, or 4.0.23, as appropriate for the release line in use. These versions include the fix.
What can be done before upgrading?
Review MQTT topic-permission templates and avoid placing {clientid} inside [...] character classes. This removes the template condition required for the described permission bypass.