Is CVE-2026-95848 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-95848 being exploited in the wild.

How severe is CVE-2026-95848?

Informational severity, published 23 September 2026.

Which products and versions are affected?

Moquette-Io Moquette prior to 0.18.1.

Is there a fix for CVE-2026-95848?

A patch was published on 2026-08-01: Fix merged in pull request #967 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-95848 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-95848?

Check whether you run Moquette-Io Moquette at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-95848: Moquette MQTT broker insecure fallback on authenticator load failure

CVE-2026-95848 · Severity: info · Published 2026-09-23

Moquette is a lightweight Java MQTT message broker used to handle device and application messaging. If the broker cannot load a configured authentication or authorization module due to misconfiguration, typos, or missing dependencies, it silently disables security controls rather than failing safely, allowing any client to connect without credentials or authorization checks.

Technologies: Moquette-Io Moquette. Vendors: Moquette-Io.

Quick answers

Is CVE-2026-95848 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-95848 being exploited in the wild.
How severe is CVE-2026-95848?: Informational severity, published 23 September 2026.
Which products and versions are affected?: Moquette-Io Moquette prior to 0.18.1.
Is there a fix for CVE-2026-95848?: A patch was published on 2026-08-01: Fix merged in pull request #967 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-95848 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-95848?: Check whether you run Moquette-Io Moquette at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy, which catch class loading failures and silently default to AcceptAllAuthenticator or PermitAllAuthorizatorPolicy instead of failing closed. An attacker or misconfigured deployment can trigger this by providing an invalid class name or unmet dependencies, resulting in an unauthenticated broker. The fix in version 0.18.1 changes the initialization to fail closed when auth/authz class loading fails.

Affected products

moquette-io Moquette prior to 0.18.1

Timeline

2026-09-23: disclosed
2026-08-01: patched: Fix merged in pull request #967

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.