# CVE-2026-95848: Moquette MQTT broker insecure fallback on authenticator load failure

Source: https://junglewise.ai/threats/cve-2026-95848-moquette-is-a-lightweight-java-mqtt-broker-prior-to-0-18-1-when-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-95848 · Severity: info · Published 2026-09-23

Moquette is a lightweight Java MQTT message broker used to handle device and application messaging. If the broker cannot load a configured authentication or authorization module due to misconfiguration, typos, or missing dependencies, it silently disables security controls rather than failing safely, allowing any client to connect without credentials or authorization checks.

Technologies: [Moquette-Io Moquette](https://junglewise.ai/threats/technologies/moquette-io-moquette). Vendors: [Moquette-Io](https://junglewise.ai/threats/vendors/moquette-io).

## Quick answers

**Is CVE-2026-95848 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-95848 being exploited in the wild.

**How severe is CVE-2026-95848?** Informational severity, published 23 September 2026.

**Which products and versions are affected?** Moquette-Io Moquette prior to 0.18.1.

**Is there a fix for CVE-2026-95848?** A patch was published on 2026-08-01: Fix merged in pull request #967 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-95848 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-95848?** Check whether you run Moquette-Io Moquette at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy, which catch class loading failures and silently default to AcceptAllAuthenticator or PermitAllAuthorizatorPolicy instead of failing closed. An attacker or misconfigured deployment can trigger this by providing an invalid class name or unmet dependencies, resulting in an unauthenticated broker. The fix in version 0.18.1 changes the initialization to fail closed when auth/authz class loading fails.

## Affected products

- moquette-io Moquette prior to 0.18.1

## Timeline

- 2026-09-23: disclosed
- 2026-08-01: patched: Fix merged in pull request #967

## References

- [https://github.com/moquette-io/moquette/commit/14a2f4fd280c8f6a791600c306cbccecb7c67007](https://github.com/moquette-io/moquette/commit/14a2f4fd280c8f6a791600c306cbccecb7c67007)
- [https://github.com/moquette-io/moquette/pull/967](https://github.com/moquette-io/moquette/pull/967)

## Related threats

- [Moquette unbounded message queue denial of service](https://junglewise.ai/threats/cve-2026-95845-moquette-is-a-lightweight-java-mqtt-broker-prior-to-0-18-1-the)
- [Moquette MQTT broker denial of service in shared subscription parsing](https://junglewise.ai/threats/cve-2026-95843-moquette-is-a-lightweight-java-mqtt-broker-prior-to-0-18-1)