RabbitMQ versions 4.0.0 up to but not including 4.0.23, 4.1.0 up to but not including 4.1.14, 4.2.0 up to but not including 4.2.9, and 4.3.2 up to but not including 4.3.3 contain a missing authorization vulnerability (CWE-862) due to an incomplete fix for CVE-2026-44838. The function escaperegexchar/1 fails to escape the '-' character, which is significant when {clientid} is placed inside a [...] character class in MQTT topic permission templates. This allows a low-privileged authenticated MQTT user controlling their clientid to broaden topic authorization (read and write) beyond intended limits. The vulnerability is resolved in versions 4.0.23, 4.1.14, 4.2.9, and 4.3.3.

An attacker with low-privileged authenticated MQTT access can bypass topic permission restrictions by exploiting improper escaping of regex metacharacters in topic permission templates. This leads to unauthorized read and write access to MQTT topics, potentially compromising message confidentiality and integrity within RabbitMQ deployments using affected versions.

Upgrade rabbitmq-server to version 4.3.3, 4.2.9, 4.1.14, or 4.0.23 or later, where this issue is fixed. No other mitigation or workaround is indicated. Patch status is confirmed fixed in these versions.