# CVE-2026-85724: Moquette MQTT broker pattern-ACL wildcard injection and authorization bypass

Source: https://junglewise.ai/threats/cve-2026-85724-moquette-mqtt-broker-pattern-acl-wildcard-injection-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-85724 · Severity: critical · CVSS 9.6 · Published 2026-09-23

Moquette is an open-source MQTT message broker used in IoT and real-time messaging systems. A critical vulnerability allows unauthenticated clients to bypass access-control rules across tenant boundaries, read and write to unauthorized topics, crash the entire broker, publish unauthorized last-will messages, and corrupt session data. This enables eavesdropping on sensitive data, service disruption, and data integrity violations in multi-tenant deployments.

Technologies: [Moquette](https://junglewise.ai/threats/technologies/moquette). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Moquette](https://junglewise.ai/threats/vendors/moquette).

## Quick answers

**Is CVE-2026-85724 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85724 being exploited in the wild.

**How severe is CVE-2026-85724?** Critical severity, with a CVSS score of 9.6, published 23 September 2026.

**Which products and versions are affected?** io.moquette:moquette-broker (Maven) <= 0.18.0, ECOSYSTEM:introduced=0,fixed=0.18.1; Moquette prior to commit da7f719a6bab9829d520b5838e13ea7b1f9be3ef (exact patched version not specified).

**Is there a fix for CVE-2026-85724?** Yes. io.moquette:moquette-broker (Maven): upgrade to 0.18.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85724 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-85724?** Check whether you run io.moquette:moquette-broker (Maven) or Moquette at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- io.moquette:moquette-broker (Maven): upgrade to 0.18.1 or later

  ```sh
  # set io.moquette:moquette-broker to 0.18.1 in your pom.xml or build.gradle
  ```


## Technical details

The vulnerability chain includes: (1) Pattern-based ACL bypass via wildcard injection—clientId containing MQTT wildcards (+, #) are substituted raw into ACL rules without validation, allowing a client with clientId "+" to transform "sensor/%c/#" into "sensor/+/#" and access cross-tenant topics; (2) unauthenticated remote DoS via uncaught exceptions in SessionEventLoop (malformed $share filters, stack overflow on deeply nested topics, NPE in ACL parsing) that wedge the entire broker; (3) Will-message authorization bypass—last-will topics bypass canWrite/reserved-topic checks; (4) cross-session durable corruption via H2 queue-name collision (clientId "sensor_meta" collides with "sensor_meta" metadata file). Attack vectors are network-accessible pre-authentication MQTT connections (default anonymous). Patches are available; mitigation requires rejecting wildcard characters in clientId/username, hardening event loop exception handling, and applying authorization to all topic operations.

## Affected products

- Moquette Moquette prior to commit da7f719a6bab9829d520b5838e13ea7b1f9be3ef (exact patched version not specified)

## Identifiers

- CVE-2026-85724
- GHSA-5f42-97gr-vfhq

## Timeline

- 2026-09-23: disclosed: Published as GHSA-5f42-97gr-vfhq
- 2026-01-00: other: CVE-2026-85724 assigned (CVE year suggests early 2026)

## Related threats

- [Moquette H2PersistentQueue client ID collision in durable sessions](https://junglewise.ai/threats/cve-2026-95847-moquette-is-a-lightweight-java-mqtt-broker-prior-to-0-18-1)
- [Moquette Last-Will authorization bypass](https://junglewise.ai/threats/cve-2026-95846-moquette-is-a-lightweight-java-mqtt-broker-prior-to-0-18-1)
- [Moquette unbounded message queue denial of service](https://junglewise.ai/threats/cve-2026-95845-moquette-is-a-lightweight-java-mqtt-broker-prior-to-0-18-1-the)
- [Moquette MQTT broker stack overflow via deeply nested topics](https://junglewise.ai/threats/cve-2026-95844-moquette-is-a-lightweight-java-mqtt-broker-prior-to-0-18-1)
- [Moquette MQTT broker denial of service in shared subscription parsing](https://junglewise.ai/threats/cve-2026-95843-moquette-is-a-lightweight-java-mqtt-broker-prior-to-0-18-1)