Regex Injection Flaw in RabbitMQ's MQTT Plugin

CVE-2026-44838

What is CVE-2026-44838?

A regex injection vulnerability exists in the MQTT plugin of RabbitMQ versions 4.2.0 to 4.2.3. This flaw arises from improper handling of user-provided client IDs in regex patterns. Since the client ID is inserted directly into the regex without escaping special characters, an authenticated user could craft input that injects malicious regex operators. This manipulation allows the user to bypass authorization mechanisms that should restrict access to topics based on client ID patterns. Administrators should upgrade to RabbitMQ version 4.2.4 or later to mitigate this risk.

References