Rabbitmq Server CVE-2026-44838

We are tasked with synthesizing data from multiple intelligence sources about CVE-2026-44838 into a comprehensive analysis, returned as a JSON object. The instructions are very specific: every field must be a plain text string, a coherent paragraph, not an array or object. We need to cross-reference all provided data.

Let's extract key information:

• Product: RabbitMQ (from description: "RabbitMQ is a messaging and streaming broker. From 4.2.0 to before 4.2.4, RabbitMQ's MQTT plugin allows..."). In CPE: cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:* so product_name: "RabbitMQ" (as the broker). Or "RabbitMQ Server"? The description says "RabbitMQ" but product_name should be 1-3 words only, specific product. Use "RabbitMQ". I'll use "RabbitMQ".
• Summary: Needs to be 2-3 sentence plain-language synthesis. Must not start with "A vulnerability..." etc. Start with specific impact verb and product. So: "Authorization bypass in RabbitMQ MQTT plugin allows authenticated users to escape regex topic restrictions." The vulnerability: regex injection due to unescaped client_id. Impact: bypass topic-level authorization, read/write to topics they shouldn't. Affected versions: 4.2.0 to before 4.2.4. Fixed in 4.2.4 and 4.3.0. No active exploitation indicated (KEV not listed, only SSVC exploitation none). EPSS 0.04% low. Patch available. So summary: "Authorization bypass in RabbitMQ's MQTT plugin (versions 4.2.0 to 4.2.3) enables authenticated MQTT users to inject regex operators into topic authorization patterns, gaining unauthorized access to messaging topics. Exploitation is not yet observed in the wild (CISA KEV not listed), and EPSS indicates low probability, but a patch is available in versions 4.2.4 and 4.3.0." That's good, mentions specific impact, product, versions, exploitation, patch.
• technical_context: Underlying technology: RabbitMQ MQTT plugin, regex pattern matching with variable substitution for topic authorization. CWE-863: Incorrect Authorization, so root c