CVE-2026-85724: Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug
(updated )
moquette is reachable by untrusted MQTT clients (anonymous by default), so every byte from any client, including pre-authentication, is untrusted. This is a memory-safe JVM: the ceiling is authorization/ACL bypass + denial of service + cross-session integrity, not RCE (I did not find one and do not claim one). Audited at commit da7f719a6bab9829d520b5838e13ea7b1f9be3ef, module broker/.
References
- github.com/advisories/GHSA-5f42-97gr-vfhq
- github.com/moquette-io/moquette/commit/14a2f4fd280c8f6a791600c306cbccecb7c67007
- github.com/moquette-io/moquette/commit/26498631e92d50440b4e3ed42fa546253cc4090c
- github.com/moquette-io/moquette/commit/72d6c8257191d2e4b2e3aa11ab25fd09f88c6cb7
- github.com/moquette-io/moquette/commit/86feb7c31e6fac849c465d8079d08c0e7ef01cdf
- github.com/moquette-io/moquette/commit/affdc71fdba92dc020421678970ae70518fb6da2
- github.com/moquette-io/moquette/commit/b4a98bb3f3425ece476ed073aa080c627c1239af
- github.com/moquette-io/moquette/commit/c65b3e90fa03e562e2c2fa69c3ee916c2cbfbd2b
- github.com/moquette-io/moquette/commit/ca17e0be19e86d5e291f4532dfdc94616c8e0049
- github.com/moquette-io/moquette/commit/d77753542e262b7aa573dee3c2b05e44439bbd96
- github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec6c96973
- github.com/moquette-io/moquette/pull/957
- github.com/moquette-io/moquette/pull/958
- github.com/moquette-io/moquette/pull/959
- github.com/moquette-io/moquette/releases/tag/v0.18.1
- github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq
- nvd.nist.gov/vuln/detail/CVE-2026-85724
Code Behaviors & Features
Detect and mitigate CVE-2026-85724 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →