CVE-2026-85724: Moquette MQTT broker pattern-ACL wildcard injection and authorization bypass

CVE-2026-85724 · Severity: critical · CVSS 9.6 · Published 2026-09-23

Moquette is an open-source MQTT message broker used in IoT and real-time messaging systems. A critical vulnerability allows unauthenticated clients to bypass access-control rules across tenant boundaries, read and write to unauthorized topics, crash the entire broker, publish unauthorized last-will messages, and corrupt session data. This enables eavesdropping on sensitive data, service disruption, and data integrity violations in multi-tenant deployments.

Technologies: Moquette. Vendors: Maven, Moquette.

Quick answers

Is CVE-2026-85724 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-85724 being exploited in the wild.
How severe is CVE-2026-85724?
Critical severity, with a CVSS score of 9.6, published 23 September 2026.
Which products and versions are affected?
io.moquette:moquette-broker (Maven) <= 0.18.0, ECOSYSTEM:introduced=0,fixed=0.18.1; Moquette prior to commit da7f719a6bab9829d520b5838e13ea7b1f9be3ef (exact patched version not specified).
Is there a fix for CVE-2026-85724?
Yes. io.moquette:moquette-broker (Maven): upgrade to 0.18.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85724 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-85724?
Check whether you run io.moquette:moquette-broker (Maven) or Moquette at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.moquette:moquette-broker (Maven): upgrade to 0.18.1 or later
    # set io.moquette:moquette-broker to 0.18.1 in your pom.xml or build.gradle

Technical details

The vulnerability chain includes: (1) Pattern-based ACL bypass via wildcard injection—clientId containing MQTT wildcards (+, #) are substituted raw into ACL rules without validation, allowing a client with clientId "+" to transform "sensor/%c/#" into "sensor/+/#" and access cross-tenant topics; (2) unauthenticated remote DoS via uncaught exceptions in SessionEventLoop (malformed $share filters, stack overflow on deeply nested topics, NPE in ACL parsing) that wedge the entire broker; (3) Will-message authorization bypass—last-will topics bypass canWrite/reserved-topic checks; (4) cross-session durable corruption via H2 queue-name collision (clientId "sensor_meta" collides with "sensor_meta" metadata file). Attack vectors are network-accessible pre-authentication MQTT connections (default anonymous). Patches are available; mitigation requires rejecting wildcard characters in clientId/username, hardening event loop exception handling, and applying authorization to all topic operations.

Affected products

  • Moquette Moquette prior to commit da7f719a6bab9829d520b5838e13ea7b1f9be3ef (exact patched version not specified)

Identifiers

  • CVE-2026-85724
  • GHSA-5f42-97gr-vfhq

Timeline

  • 2026-09-23: disclosed: Published as GHSA-5f42-97gr-vfhq
  • 2026-01-00: other: CVE-2026-85724 assigned (CVE year suggests early 2026)

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.