RabbitMQ versions 4.2.0 through 4.2.3 allow an authenticated MQTT user to craft a CONNECT packet containing a malicious client identifier. The broker substitutes this client_id into a regular‑expression based topic authorization pattern without escaping regex metacharacters, enabling injection of regex operators. This flaw lets the attacker exploit the authorization checks, gaining unauthorized read or write access to MQTT topics that should be protected.

The vulnerability affects RabbitMQ Server public releases from 4.2.0 up to (but excluding) 4.2.4. It is also present in earlier 4.3.x releases before 4.3.0. All installations that enable the MQTT plugin and use user‑supplied client IDs in topic patterns are susceptible.

The CVSS score of 5.3 indicates a moderate impact. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, reducing the likelihood of widespread exploitation. The attack vector requires an authenticated MQTT user, but once authenticated it can bypass topic permissions across the broker, potentially allowing an insider or compromised client to expose or alter data on protected topics.