RabbitMQ's MQTT plugin implements topic-level authorization by constructing regex patterns that include the client_id variable supplied by the user in the MQTT CONNECT packet. From versions 4.2.0 to before 4.2.4, the client_id is not properly escaped when inserted into the regex pattern, enabling an authenticated user to inject regex operators. This injection can circumvent intended authorization restrictions on MQTT topics. The vulnerability corresponds to CWE-863 (Incorrect Authorization). It was addressed by RabbitMQ in versions 4.2.4 and 4.3.0.

An authenticated MQTT user can bypass topic-level authorization restrictions by injecting regex operators via the client_id field. This allows unauthorized access to MQTT topics that should be restricted, potentially exposing sensitive messaging data or enabling unauthorized message publication or subscription. The impact is limited to authenticated users and depends on the MQTT plugin's use of regex-based authorization with client_id substitution.

A fix for this vulnerability is available in RabbitMQ versions 4.2.4 and 4.3.0. Users should upgrade affected RabbitMQ server instances to at least version 4.2.4 to remediate this issue. No vendor advisory content contradicts this; therefore, upgrading is the recommended mitigation.