# CVE-2026-95846: Moquette Last-Will authorization bypass

Source: https://junglewise.ai/threats/cve-2026-95846-moquette-is-a-lightweight-java-mqtt-broker-prior-to-0-18-1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-95846 · Severity: high · CVSS 7.5 · Published 2026-09-23

Moquette is a lightweight Java MQTT broker used to manage message routing in IoT and real-time systems. A flaw in versions before 0.18.1 allows an attacker to publish messages to restricted topics by configuring a Last-Will message on a topic they lack write permission to. When the attacker's connection drops unexpectedly, the broker publishes the unauthorized message, allowing injection of malicious content into protected channels.

Technologies: [Moquette](https://junglewise.ai/threats/technologies/moquette). Vendors: [Moquette](https://junglewise.ai/threats/vendors/moquette).

## Quick answers

**Is CVE-2026-95846 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-95846 being exploited in the wild.

**How severe is CVE-2026-95846?** High severity, with a CVSS score of 7.5, published 23 September 2026.

**Which products and versions are affected?** Moquette before 0.18.1.

**Is there a fix for CVE-2026-95846?** A patch was published on 2026-08-01: Version 0.18.1 released with authorization check for Last Will messages Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-95846 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-95846?** Check whether you run Moquette at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The PostOffice.publishWill method fails to apply canWrite authorization checks and reserved-topic validation when publishing a client's Last-Will message, whereas normal PUBLISH operations enforce these restrictions. A connected attacker can exploit this by setting a Will message on a topic for which they lack write permissions; upon unexpected disconnection, the broker publishes the unauthorized message. The vulnerability is fixed in version 0.18.1 by adding authorization checks at connection time.

## Affected products

- Moquette Moquette before 0.18.1

## Timeline

- 2026-09-23: disclosed
- 2026-08-01: patched: Version 0.18.1 released with authorization check for Last Will messages

## References

- [https://github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec6c96973](https://github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec6c96973)
- [https://github.com/moquette-io/moquette/releases/tag/v0.18.1](https://github.com/moquette-io/moquette/releases/tag/v0.18.1)

## Related threats

- [Moquette H2PersistentQueue client ID collision in durable sessions](https://junglewise.ai/threats/cve-2026-95847-moquette-is-a-lightweight-java-mqtt-broker-prior-to-0-18-1)
- [Moquette unbounded message queue denial of service](https://junglewise.ai/threats/cve-2026-95845-moquette-is-a-lightweight-java-mqtt-broker-prior-to-0-18-1-the)
- [Moquette MQTT broker stack overflow via deeply nested topics](https://junglewise.ai/threats/cve-2026-95844-moquette-is-a-lightweight-java-mqtt-broker-prior-to-0-18-1)
- [Moquette MQTT broker denial of service in shared subscription parsing](https://junglewise.ai/threats/cve-2026-95843-moquette-is-a-lightweight-java-mqtt-broker-prior-to-0-18-1)
- [Moquette MQTT broker event loop denial of service](https://junglewise.ai/threats/cve-2026-95842-moquette-is-a-lightweight-java-mqtt-broker-prior-to-0-18-1)