[ CVE-2026-85724 · Published 23 Sep 2026 ]
Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug
CVSS 9.6
EPSS <1%Fix available
[ Why it matters ]Priority signals
- Public proof-of-concept exploit exists (CISA SSVC)
- Critical severity: CVSS 9.6
[ Description ]Official description
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses + or # in either identity can broaden the substituted filter and gain cross-tenant read and write access. A # identity can also produce an invalid filter that triggers a NullPointerException in Topic.match and disrupts session processing. This issue is fixed in version 0.18.1.
[ Fixes ]Fixes and patches
- io.moquette:moquette-broker 0.18.1Fixed version · GitHub Advisories · maven package io.moquette:moquette-broker: upgrade to 0.18.1 or later (affected <= 0.18.0)
- Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
[ Packages ]Affected open-source packages
- io.moquette:moquette-broker mavenAffected <= 0.18.0 · fixed in 0.18.1 · GHSA-5f42-97gr-vfhq