Executive brief
Moquette is an open-source MQTT message broker used in IoT and real-time messaging systems. A critical vulnerability allows unauthenticated clients to bypass access-control rules across tenant boundaries, read and write to unauthorized topics, crash the entire broker, publish unauthorized last-will messages, and corrupt session data. This enables eavesdropping on sensitive data, service disruption, and data integrity violations in multi-tenant deployments.
Technical details
The vulnerability chain includes: (1) Pattern-based ACL bypass via wildcard injection—clientId containing MQTT wildcards (+, #) are substituted raw into ACL rules without validation, allowing a client with clientId "+" to transform "sensor/%c/#" into "sensor/+/#" and access cross-tenant topics; (2) unauthenticated remote DoS via uncaught exceptions in SessionEventLoop (malformed $share filters, stack overflow on deeply nested topics, NPE in ACL parsing) that wedge the entire broker; (3) Will-message authorization bypass—last-will topics bypass canWrite/reserved-topic checks; (4) cross-session durable corruption via H2 queue-name collision (clientId "sensor_meta" collides with "sensor_meta" metadata file). Attack vectors are network-accessible pre-authentication MQTT connections (default anonymous). Patches are available; mitigation requires rejecting wildcard characters in clientId/username, hardening event loop exception handling, and applying authorization to all topic operations.
Affected products
- Moquette Moquette prior to commit da7f719a6bab9829d520b5838e13ea7b1f9be3ef (exact patched version not specified)
Timeline
- 2026-09-23: disclosed: Published as GHSA-5f42-97gr-vfhq
- 2026-01-00: other: CVE-2026-85724 assigned (CVE year suggests early 2026)