CVE-2026-85058 Details
Description
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers without invoking the authorizator.canWrite check used by normal PUBLISH paths. When anonymous access is enabled and topic ACLs restrict writes, a remote client can set an ACL-protected topic as the Last Will Topic during CONNECT and perform an abnormal client disconnect, causing the broker to inject attacker-controlled messages into a topic for which the client lacks write permission. This issue is fixed in version 0.18.1.
An authorization bypass vulnerability has been identified in Moquette, a lightweight Java MQTT broker, in versions prior to 0.18.1. The issue arises in the handling of Last Will messages, which are published on behalf of clients that disconnect abnormally. The vulnerability allows an unauthenticated client, when anonymous access is enabled, to inject messages into ACL-protected topics by exploiting the Last Will feature. This is achieved by setting a restricted topic as the Last Will topic during the CONNECT phase and then disconnecting abruptly, bypassing the authorization checks that are normally applied to published messages.
Users are advised to upgrade to Moquette version 0.18.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/moquette-io/moquette/security/advisories/GHSA-9jjc-fw8x-fmwx | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/moquette-io/moquette/commit/e23df019f6a11e22c7d2047d4f86d07095466c97 | [email protected] | Source CodeVendor |
| https://github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec6c96973 | [email protected] | Source CodeVendor |
| https://github.com/moquette-io/moquette/releases/tag/v0.18.1 | [email protected] | Release NotesVendor |
| https://github.com/moquette-io/moquette/security/advisories/GHSA-9jjc-fw8x-fmwx | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Moquette | <= 0.18.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |