CVE-2026-67407

Undergoing Analysis Undergoing Analysis - In Progress

MQTT Topic Permission Bypass in RabbitMQ

Publication date: 2026-09-25

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3 and 4.2.9 and 4.1.14 and 4.0.23, Incomplete fix for CVE-2026-44838: escaperegexchar/1 does not escape -, leaving room for an MQTT topic permission bypass. the CVE-2026-44838 fix made expandtopicpermission/2 escape regex metacharacters in expanded topic-permission variables (escaperegex(V)), but escaperegexchar/1 escapes \ ^ $ . | ? + ( ) [ ] { } and omits -. When a topic permission template places {clientid} inside a [...] character class A low-privileged authenticated MQTT user controlling its clientid can broaden topic authorization (read and write) when templates embed {clientid} in a [...] This issue is fixed in versions 4.3.3 and 4.2.9 and 4.1.14 and 4.0.23.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-28

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-67407

EUVD

EUVD-2026-87236

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq	From 4.0.0 (inc) to 4.3.3 (inc)
rabbitmq	rabbitmq	to 4.2.9 (inc)
rabbitmq	rabbitmq	to 4.1.14 (inc)
rabbitmq	rabbitmq	to 4.0.23 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

RabbitMQ versions 4.0.0 to 4.3.3 and 4.2.9 and 4.1.14 and 4.0.23 have a flaw where the escaperegexchar/1 function does not escape the hyphen (-) character. This allows an MQTT user with low privileges to bypass topic permissions by setting a clientid that includes a hyphen within a character class in a topic permission template.

Detection Guidance

To detect this vulnerability, check RabbitMQ versions between 4.0.0 and 4.3.3, 4.2.9, 4.1.14, and 4.0.23. Verify if MQTT topic permissions use {clientid} in character classes like [...]. Inspect RabbitMQ logs for unusual topic authorization patterns.

Impact Analysis

An attacker with low-privileged access could exploit this to gain unauthorized read or write permissions on MQTT topics they should not have access to. This could lead to data leaks or unauthorized message manipulation.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements or HIPAA's privacy rules. Organizations using affected RabbitMQ versions may face compliance violations if data is exposed.

Mitigation Strategies

Upgrade RabbitMQ to version 4.3.3 or 4.2.9 or 4.1.14 or 4.0.23 or later to address the incomplete fix for CVE-2026-44838.

Hi! I’m here to help you understand CVE-2026-67407. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70