The vulnerability arises from an incomplete escape routine used to construct MQTT topic permission expressions. The function escapes many regex metacharacters but omits the hyphen, allowing an attacker to insert a hyphen within a character class of a topic permission template. A low‑privileged authenticated MQTT user who controls the client identifier can craft a malicious identifier that expands the intended pattern, granting read or write access to MQTT topics that were not originally authorized. The flaw permits unauthorized topic access by manipulating permission templates, representing a breach of confidentiality and integrity for MQTT messages. Based on the description, the attack vector likely involves crafting a malicious client identifier through the MQTT connection.

The affected product is RabbitMQ Server. Versions from 4.0.0 up to and including 4.3.3, 4.2.9, 4.1.14, and 4.0.23 contain the incomplete escape logic and are vulnerable. Versions 4.3.3, 4.2.9, 4.1.14, and 4.0.23 provide the fix.

The vulnerability carries a CVSS score of 5.1, indicating moderate severity. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. Exploitation requires a valid MQTT connection and a low‑privileged authenticated account; the attacker must control the client identifier. Since many environments allow MQTT for many users, the potential for exploitation is present, but lack of EPSS data suggests exploitation likelihood remains uncertain.