CVE catalog
CVE-2026-44838
RabbitMQ is a messaging and streaming broker. From 4.2.0 to before 4.2.4, RabbitMQ's MQTT plugin allows for topic-level authorization using regular expressions with variable substitution. Administrato
- Severity
- High · CVSS 8.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.20% · Oct 25, 2026
RabbitMQ is a messaging and streaming broker. From 4.2.0 to before 4.2.4, RabbitMQ's MQTT plugin allows for topic-level authorization using regular expressions with variable substitution. Administrators can create patterns such as ^{client_id}-sensors$ to restrict user access to topics that include their client ID. However, the client_id is provided by the user in the MQTT CONNECT packet and is inserted into the regex pattern without escaping special regex characters. This flaw enables an authenticated MQTT user to inject regex operators to bypass authorization. This vulnerability is fixed in 4.2.4 and 4.3.0.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | rabbitmq-server | sid | 4.3.6-1 | not affected |
| Debian | rabbitmq-server | forky | 4.3.6-1 | not affected |
| Debian | rabbitmq-server | trixie | 4.0.5-6+deb13u2 | not affected |
| Debian | rabbitmq-server | bookworm | 3.10.8-1.1+deb12u1 | not affected |
| Debian | rabbitmq-server | bookworm-security | 3.10.8-1.1+deb12u1 | not affected |
| Cpe | rabbitmq_server | Not reported | 4.2.4 | fixed |
| Cpe | rabbitmq_server | Not reported | 4.2.4 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | rabbitmq-server | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | rabbitmq-server | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | rabbitmq-server | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | rabbitmq-server | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Cpe | rabbitmq_server | cpe | Not reported | 4.2.4 | Not reported | Not reported | Not reported |
| Cpe | rabbitmq_server | cpe | Not reported | 4.2.4 | Not reported | NVD-CVE-2026-44838 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [rabbitmq-server]Not affected
Details (4)
3.10.8-1.1+deb12u1· all · bookwormNot affected
nvd · rabbitmq-server · debian · bookworm
3.10.8-1.1+deb12u1· all · bookwormNot affected
nvd · rabbitmq-server · debian · bookworm
3.10.8-1.1+deb12u1· all · bookworm-securityNot affected
nvd · rabbitmq-server · debian · bookworm
3.10.8-1.1+deb12u1· all · bookworm-securityNot affected
nvd · rabbitmq-server · debian · bookworm
Observed:
References
- [https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-x866-xp2g-cx8v]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-44838]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-44838]
- [https://security-tracker.debian.org/tracker/CVE-2026-44838]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44838.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1397.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]