RabbitMQ MQTT Topic Permission Bypass via Incomplete Fix in escape_regex_char (CVE-2026-44838)

CVE-2026-44838: RabbitMQ MQTT Topic Permission Bypass Vulnerability Vulnerability Overview Vulnerability Type: Incomplete Fix Severity: Moderate (CVSS 5.1/10) Description: The fix for CVE-2026-44838 used to escape regular expression metacharacters in extended topic permission variables within . However, does not escape the character. This allows low-privileged MQTT clients to bypass topic permission restrictions by embedding in the , thereby expanding their read and write permissions. Affected Range Affected Products: RabbitMQ (internal authorization backend + plugin topic permissions) Affected Versions: - - - - Fixed Versions: - 4.3.3 - 4.2.9 - 4.1.14 - 4.0.23 Vulnerability Principle When is embedded in a topic permission template, RabbitMQ supports regular expression-based topic permissions. The OAuth2 scope extension code is responsible for performing escaping in this context. However, failed to escape the character. Attackers can inject into the to alter regular expression matching behavior, thereby bypassing permission checks. Reproduction Steps Using the provided reproduction materials, set to: > Confirmed on official : A single legitimate placeholder message is published. Impact Low-privileged authenticated MQTT users (who can control their ) can expand topic authorization (read and write) when the template includes . In classic mode, all actual regex permission checks require a template shape; however, RabbitMQ supports regex topic permissions, and its OAuth2 scope extension code has already implemented escaping for this scope. Remediation Add escaping for in to align with Erlang's implementation. Add a regression test to verify the regular expression after OAuth2 scope extension: This should produce , and must be denied. Additional Information CVE ID: CVE-2026-47407 Reporter: sec-revers Disclosure Method: As part of incomplete patch measurement research (responsible disclosure)

Goal Reached Thanks to every supporter — we hit 100%!

RabbitMQ MQTT Topic Permission Bypass via Incomplete Fix in escape_regex_char (CVE-2026-44838)

More from this source