CVE-2026-85058: io.moquette:moquette-broker has a Missing Authorization issue
Moquette MQTT Broker fails to enforce ACL write permission checks when publishing Will (Last Will and Testament) messages on behalf of disconnected clients. All normal PUBLISH paths (receivedPublishQos0, receivedPublishQos1, receivedPublishQos2) correctly invoke authorizator.canWrite() before publishing, but the Will message publishing path (fireWill() → publishWill() → publish2Subscribers()) completely bypasses this authorization check.
This allows an unauthenticated attacker (when allow_anonymous=true, which is the default) to inject arbitrary messages into any ACL-protected topic by setting a restricted topic as the Will Topic in the CONNECT packet and then disconnecting abruptly via TCP RST.
Other major MQTT Broker implementations (Mosquitto, EMQX, HiveMQ) correctly enforce ACL checks on Will messages, confirming this is a bug, not a design choice.
References
- github.com/advisories/GHSA-9jjc-fw8x-fmwx
- github.com/moquette-io/moquette/commit/e23df019f6a11e22c7d2047d4f86d07095466c97
- github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec6c96973
- github.com/moquette-io/moquette/releases/tag/v0.18.1
- github.com/moquette-io/moquette/security/advisories/GHSA-9jjc-fw8x-fmwx
- nvd.nist.gov/vuln/detail/CVE-2026-85058
Code Behaviors & Features
Detect and mitigate CVE-2026-85058 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →