Critical severity · published Sep 23, 2026
CVE-2026-85724
Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass
9.6
CVSS
0.3%
EPSS
No
On KEV
Description
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses + or # in either identity can broaden the substituted filter and gain cross-tenant read and write access. A # identity can also produce an invalid filter that triggers a NullPointerException in Topic.match and disrupts session processing. This issue is fixed in version 0.18.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
moquette · moquette-io
< 0.18.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-85724
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-85724
Patch
https://github.com/moquette-io/moquette/commit/b4a98bb3f3425ece476ed073aa080c627c1239af
Release Notes
https://github.com/moquette-io/moquette/releases/tag/v0.18.1
Exploit
https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq
More from moquette
9.1
CVE-2026-95848
Moquette fails open when configured authentication or authorization classes cannot load
7.5
CVE-2026-95847
Moquette client IDs can cause cross-session H2 durable-queue corruption
7.5
CVE-2026-95846
Moquette publishes Last-Will messages without enforcing write authorization
7.5
CVE-2026-95845
Moquette unbounded per-session message queues allow memory exhaustion
7.5
CVE-2026-95844
Moquette deeply nested MQTT topics can cause stack exhaustion