CRITICAL 9.6 GitHub
CVE-2026-85724
Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and
moquette is reachable by untrusted MQTT clients (anonymous by default), so every byte from any client, including pre-authentication, is untrusted. This is a memory-safe JVM: the ceiling is authorization/ACL bypass + denial of service + cross-session integrity, **not RCE** (I did not find one and do not claim one). Audited at commit `da7f719a6bab9829d520b5838e13ea7b1f9be3ef`, module `broker/`.
## What a connecting client can do
1. (Critical) Bypass `pattern`-based ACLs across tenants. In `Autho
Affected Products
- maven/io.moquette:moquette-broker <= 0.18.0
References
- https://github.com/advisories/GHSA-5f42-97gr-vfhq
- https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq
- https://github.com/moquette-io/moquette/pull/957
- https://github.com/moquette-io/moquette/pull/958
This critical severity vulnerability with a CVSS score of 9.6 was published on 2026-09-23 via GitHub. Affected: maven/io.moquette:moquette-broker <= 0.18.0.
Risk Timeline
CVE Disclosed2026-09-23 · -1 days ago
Remediation Resources
Related Vulnerabilities
| CVE | Title | Severity | CVSS |
|---|---|---|---|
| CVE-2026-73247 | Kestra: SSRF via Pebble http() function allows unauthenticated access to interna | HIGH | 8.6 |
| CVE-2026-73245 | Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env | MEDIUM | 6.5 |
vulnfeed aggregates 12912 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.