CVE-2026-85058highCWE-862

CVE-2026-85058: high-severity vulnerability in moquette-io moquette

Moquette: Missing Authorization in io.moquette:moquette-broker

Published · Updated

Follow this CVE+ Monitor moquette+ Monitor io.moquette:moquette-broker

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.6%
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers without invoking the authorizator.canWrite check used by normal PUBLISH paths. When anonymous access is enabled and topic ACLs restrict writes, a remote client can set an ACL-protected topic as the Last Will Topic during CONNECT and perform an abnormal client disconnect, causing the broker to inject attacker-controlled messages into a topic for which the client lacks write permission. This issue is fixed in version 0.18.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
moquette-io · moquette
Related CVEs — moquette-io moquette

In the same product, most dangerous first.

CVE-2026-95842HIGHMoquette uncaught MQTT command exceptions can terminate shared session event loopsEPSS 0.4%CVE-2026-95843HIGHMoquette malformed shared subscriptions can crash command processingEPSS 0.4%CVE-2026-95848CRITICALMoquette fails open when configured authentication or authorization classes cannot loadEPSS 0.4%CVE-2026-95844HIGHMoquette deeply nested MQTT topics can cause stack exhaustionEPSS 0.4%CVE-2026-95845HIGHMoquette unbounded per-session message queues allow memory exhaustionEPSS 0.4%CVE-2026-95847HIGHMoquette client IDs can cause cross-session H2 durable-queue corruptionEPSS 0.3%