CVE-2026-67407

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 4.0.0 through 4.0.22 RabbitMQ versions 4.1.0 through 4.1.13 RabbitMQ versions 4.2.0 through 4.2.8 RabbitMQ versions 4.3.0 through 4.3.2

Description An incomplete fix in the MQTT topic permission handling allows a low-privileged authenticated user to bypass authorization. The expandtopicpermission/2 function uses escaperegexchar/1 to escape regex metacharacters in topic-permission variables, but the escaperegexchar/1 function fails to escape the hyphen (-) character. If a topic permission template places the {clientid} variable inside a [...] character class, a user controlling their clientid can broaden their read and write authorization permissions.

Recommendations Update to version 4.0.23 Update to version 4.1.14 Update to version 4.2.9 Update to version 4.3.3