Executive brief
RabbitMQ is a widely used message broker that helps different applications communicate with each other. A security flaw in its MQTT messaging component allows authenticated users to bypass restrictions on which message topics they can access. This could allow an attacker to read sensitive data from other users or send unauthorized commands to different parts of the system.
Technical details
The vulnerability is an incorrect authorization flaw (CWE-863) within the RabbitMQ MQTT plugin. When administrators use variable substitution (e.g., {client_id}) in regular expressions to define topic permissions, the plugin fails to escape special regex characters in the user-provided client ID from the MQTT CONNECT packet. An authenticated attacker can provide a malicious client ID containing regex metacharacters (such as '.*') to broaden the scope of the regex pattern. This allows the attacker to subscribe to or publish to topics that should otherwise be restricted. The issue is fixed in RabbitMQ versions 4.2.4 and 4.3.0.
Affected products
- RabbitMQ RabbitMQ server 4.2.0 to 4.2.3, 4.3.0-rc versions
Timeline
- 2026-05-06: advisory: Vendor advisory published on GitHub
- 2026-05-27: disclosed: CVE published to NVD