Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
CVE-2026-85724: Moquette broker lets unauthorized access and cause crash
CVE-2026-85724 · published 21 days ago
Summary
The Moquette MQTT broker (versions before 0.18.1) lets a client use special characters in its ID or username to expand permission rules, giving it the ability to read or write data belonging to other users. That same trick can also cause the broker to crash, interrupting service. Update the broker to version 0.18.1 or later to stop the unauthorized access and prevent crashes.
What to do
- Update moquette io.moquette:moquette-broker to version 0.18.1.
- Update io.moquette:moquette-broker to version 0.18.1.
- Update moquette moquette to version 0.18.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | moquette | io.moquette:moquette-broker |
<= 0.18.0 Fix: upgrade to 0.18.1
|
| – | moquette-io | moquette | < 0.18.1 |
| maven | – | io.moquette:moquette-broker |
<= 0.18.0 Fix: upgrade to 0.18.1
|
| – | moquette | moquette |
< 0.18.1 cpe:2.3:a:moquette:moquette:*:*:*:*:*:*:*:* |
| Maven | – | io.moquette:moquette-broker |
< 0.18.1 Fix: upgrade to 0.18.1
|
Original advisory text
Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses + or # in either identity can broaden the substituted filter and gain cross-tenant read and write access. A # identity can also produce an invalid filter that triggers a NullPointerException in Topic.match and disrupts session processing. This issue is fixed in version 0.18.1.
References
- https://github.com/moquette-io/moquette/pull/959
- https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq Exploit Mitigation Vendor Advisory
- https://github.com/moquette-io/moquette/pull/957
- https://github.com/moquette-io/moquette/pull/958
- https://github.com/moquette-io/moquette/commit/26498631e92d50440b4e3ed42fa546253...
- https://github.com/moquette-io/moquette/commit/72d6c8257191d2e4b2e3aa11ab25fd09f...
- https://github.com/moquette-io/moquette/commit/86feb7c31e6fac849c465d8079d08c0e7...
- https://github.com/moquette-io/moquette/commit/affdc71fdba92dc020421678970ae7051...
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85724... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-85724 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95842... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-95842 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95843... Vendor Advisory
- https://github.com/moquette-io/moquette/pull/962 Patch
- https://nvd.nist.gov/vuln/detail/CVE-2026-95843 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95844... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-95844 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95845... Vendor Advisory
- https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce... Patch
- https://nvd.nist.gov/vuln/detail/CVE-2026-95845 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95846... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-95846 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95847... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-95847 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95848... Vendor Advisory
- https://github.com/moquette-io/moquette/pull/967 Patch
- https://nvd.nist.gov/vuln/detail/CVE-2026-95848 Vendor Advisory
- https://github.com/moquette-io/moquette/commit/14a2f4fd280c8f6a791600c306cbccecb...
- https://github.com/moquette-io/moquette/commit/b4a98bb3f3425ece476ed073aa080c627... Patch
- https://github.com/moquette-io/moquette/commit/c65b3e90fa03e562e2c2fa69c3ee916c2...
- https://github.com/moquette-io/moquette/commit/d77753542e262b7aa573dee3c2b05e444...
- https://github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec...
- https://github.com/advisories/GHSA-5f42-97gr-vfhq
- https://github.com/moquette-io/moquette/releases/tag/v0.18.1 Release Notes
- https://github.com/moquette-io/moquette/commit/ca17e0be19e86d5e291f4532dfdc94616...
- https://github.com/moquette-io/moquette/pull/964 Patch
- https://github.com/moquette-io/moquette Product
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.7
High
Type
CWE-155Improper Neutralization of Wildcards or Matching Symbols
CWE-863Incorrect Authorization
CWE-99Improper Control of Resource Identifiers ('Resource Injection')
CWE-248Uncaught Exception
CWE-862Missing Authorization
CWE-636Not Failing Securely ('Failing Open')
CWE-770Allocation of Resources Without Limits
CWE-674Uncontrolled Recursion
CWE-20Improper Input Validation
Timeline
Published23 Sep 2026
Updated12 Oct 2026
First seen23 Sep 2026
Sources
GHSA-5f42-97gr-vfhq · GHSA
CVE-2026-85724 · NVD
CVE-2026-85724 · MITRE
CVE-2026-85724 · OSV
CVE-2026-95846 · OSV
CVE-2026-95844 · OSV
CVE-2026-95847 · OSV
GHSA-5f42-97gr-vfhq · OSV
Track software like this
Free during beta