CVE-2026-85724
Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug
moquette is reachable by untrusted MQTT clients (anonymous by default), so every byte from any client, including pre-authentication, is untrusted. This is a memory-safe JVM: the ceiling is authorization/ACL bypass + denial of service + cross-session integrity, not RCE (I did not find one and do not claim one). Audited at commit da7f719a6bab9829d520b5838e13ea7b1f9be3ef, module broker/.
- No known exploitation
- Severity
- Critical, CVSS 9.6 (v3.1)
- EPSS
- 0.27% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- io.moquette:moquette-broker (maven) <= 0.18.0, fixed in 0.18.1 · GHSA-5f42-97gr-vfhq