RabbitMQ Web MQTT uses a PROXY Protocol frontend that, between version 3.13.0 and the latest patched releases, can discard the client address derived from the proxy before checking the loopback_users list during MQTT authentication. This allows an attacker who can reach the trusted frontend and possesses credentials for a loopback‑restricted account to bypass the broker’s source‑address restriction while still requiring normal password authentication. The result is that the broker treats the connection as originating from a loopback address, enabling the attacker to access functions or topics that are otherwise limited to local traffic. The weakness is classified as CWE‑863, a breach of access control enforcement.

The flaw affects RabbitMQ Server versions 3.13.0 through 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3. Clients and brokers using the RabbitMQ server in this version range, with MQTT over WebSocket configured behind a trusted PROXY Protocol frontend, are vulnerable until the broker is upgraded to a patched release.

The vulnerability carries a CVSS score of 6, indicating moderate severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. A practical exploit requires network access to the trusted frontend and valid user credentials for a loopback‑restricted account, making it a network‑based privilege escalation scenario. Once the attacker bypasses the source‑address restriction, they can read or publish messages on topics that are normally constrained to local‑only clients.