CVE-2026-67407: RabbitMQ MQTT Auth Bypass Vulnerability

CVE-2026-67407 Overview

CVE-2026-67407 is an authorization bypass vulnerability in RabbitMQ, an open-source messaging and streaming broker. The flaw affects MQTT topic permission enforcement and stems from an incomplete fix for CVE-2026-44838. The escape_regex_char/1 helper escapes several regex metacharacters but omits the hyphen (-). A low-privileged authenticated MQTT client that controls its own clientid can leverage this gap to broaden topic read and write authorization when permission templates embed {clientid} inside a [...] character class. The issue is categorized under [CWE-862: Missing Authorization].

Critical Impact
An authenticated MQTT user can bypass topic-level authorization and gain unauthorized read or write access to messaging topics when operators use {clientid} substitution inside regex character classes.

Affected Products

RabbitMQ versions 4.0.0 through 4.0.22
RabbitMQ 4.1.x prior to 4.1.14 and 4.2.x prior to 4.2.9
RabbitMQ 4.3.x prior to 4.3.3

Discovery Timeline

2026-09-25 - CVE-2026-67407 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-67407

Vulnerability Analysis

RabbitMQ supports topic-permission templates that substitute runtime values such as {username}, {vhost}, and {clientid} into regex patterns used for MQTT topic authorization. The prior fix for CVE-2026-44838 introduced escape_regex(V) inside expand_topic_permission/2 to prevent user-controlled substitution values from injecting regex metacharacters. The helper function escape_regex_char/1 escapes \ ^ $ . | ? + ( ) [ ] { } but does not escape the hyphen character. When operators place {clientid} inside a [...] character class, the unescaped hyphen is interpreted as a range operator rather than a literal character. An authenticated MQTT client that controls its own clientid can craft a value that expands the compiled character class to cover a wider set of topic names than the policy intended.

Root Cause

The root cause is incomplete sanitization in escape_regex_char/1. The function omits the - character, which has special meaning inside POSIX and PCRE character classes. The partial fix left the regex-generation path exploitable in templates that embed user-controlled identifiers inside [...].

Attack Vector

An attacker needs valid MQTT credentials and the ability to choose an arbitrary clientid. The attacker connects to the broker with a crafted clientid containing one or more hyphens positioned to create a wide character range. The expanded regex then grants read or write access to topics that the operator did not intend to authorize. Exploitation requires that the deployed topic-permission template use {clientid} inside a [...] character class. See the GitHub Security Advisory GHSA-q46v-hrvq-hp24 for the complete technical description.

Detection Methods for CVE-2026-67407

Indicators of Compromise

MQTT CONNECT packets with clientid values containing hyphens placed adjacent to alphanumeric characters, suggesting an attempt to form a character range.
Successful MQTT PUBLISH or SUBSCRIBE operations on topics outside a client's expected namespace, correlated with unusual clientid patterns.
Audit log entries showing a single authenticated user accessing a broader set of topics than historical baseline access.

Detection Strategies

Review RabbitMQ topic-permission policies for any template that embeds {clientid}, {username}, or {vhost} inside a [...] character class and flag them as high risk.
Enable RabbitMQ authorization and connection logging, then alert on MQTT clients whose clientid contains regex metacharacters, particularly -.
Correlate MQTT subscription patterns against expected per-client topic scopes to detect lateral topic access.

Monitoring Recommendations

Forward RabbitMQ connection, authentication, and authorization logs to a centralized SIEM for retention and anomaly detection.
Baseline MQTT clientid character sets accepted by production brokers and alert on clients that deviate from the expected format.
Track topic-permission policy changes in configuration management to catch risky template patterns before deployment.

How to Mitigate CVE-2026-67407

Immediate Actions Required

Upgrade RabbitMQ to a fixed release: 4.3.3, 4.2.9, 4.1.14, or 4.0.23.
Audit existing topic-permission templates and remove or rewrite any pattern that places {clientid} or other substitution variables inside a [...] character class.
Enforce server-side validation of MQTT clientid values, restricting them to a safe character set such as [A-Za-z0-9_].

Patch Information

The RabbitMQ maintainers resolved CVE-2026-67407 by updating escape_regex_char/1 to also escape the hyphen character, completing the fix originally shipped for CVE-2026-44838. Patched artifacts are available in the RabbitMQ 4.3.3 release and the RabbitMQ 4.2.9 release. Operators on the 4.1 and 4.0 branches should upgrade to 4.1.14 or 4.0.23 respectively.

Workarounds

Replace character-class patterns with explicit alternations or anchored prefixes that do not rely on substituted user input.
Reject MQTT connections whose clientid contains characters outside an allow-list, enforced at a proxy or authentication plugin.
Scope MQTT users to narrow virtual hosts so that any accidental broadening of a regex still cannot cross tenant boundaries.

bash

# Example: restrict MQTT clientid characters via a safe topic-permission template
# Avoid: ^device/[{clientid}]/data$   (vulnerable when clientid contains '-')
# Prefer explicit, anchored substitution outside a character class:
rabbitmqctl set_topic_permissions -p / mqtt-user amq.topic \
  "^device\.{clientid}\..*$" \
  "^device\.{clientid}\..*$"