CVE-2026-85432 in core-moos
Summary
by MITRE • 09/04/2026
MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers can forge message origins and cancel third-party subscriptions by exploiting the disconnect between authenticated connection identity and wire-supplied source attribution.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified within MOOS core-moos versions through 10.4.0 represents a critical failure in server-side input validation, specifically concerning the handling of client identity during database operations. The Mission Oriented Operating Suite is widely utilized for autonomous vehicle coordination and robotics applications, where reliable message passing between distributed nodes is essential for system integrity. In this architecture, the MOOSDB serves as the central hub for data exchange, relying on TCP connections to manage communication channels. While the initial connection establishment involves authentication mechanisms that verify the identity of the connecting client, the subsequent processing of messages within the database fails to enforce a strict binding between the authenticated session and the metadata contained within the message payload itself. This architectural oversight creates a significant trust boundary violation where the system assumes that the source identifier provided in the serialized data packet accurately reflects the entity sending it, rather than verifying this against the established connection context.
From a technical perspective, the flaw lies in the deserialization and processing logic of MOOSDB messages. When an authenticated client sends a message to write data or modify subscriptions, the server accepts the source identifier field embedded within that serialized structure without cross-referencing it with the identity associated with the active TCP socket. This allows an attacker who has already gained authentication credentials for one account to manipulate these fields in their requests. By injecting arbitrary values into the source identifier field, the attacker can effectively spoof the origin of any message they transmit. The server processes these messages as if they originated from the forged entity, thereby bypassing access controls and audit trails that are typically tied to specific user identities or node names within the MOOS ecosystem.
The operational impact of this vulnerability is severe due to its potential for data integrity compromise and service disruption in critical systems. An authenticated attacker can forge message origins to attribute malicious writes to innocent third-party clients, leading to false accusations, corrupted decision-making processes in autonomous agents, and difficulty in forensic analysis during incident response. Furthermore, the ability to manipulate subscription metadata allows attackers to cancel subscriptions belonging to other users or nodes. This denial of service capability disrupts data flow within the network, potentially causing robotic systems to lose situational awareness or coordination capabilities. In environments where MOOS is used for safety-critical applications such as unmanned aerial vehicles or autonomous underwater vehicles, such disruptions could lead to catastrophic failures in mission execution and physical safety.
This vulnerability aligns with CWE-287, which describes Improper Authentication, specifically the failure to verify identity during transaction processing, and CWE-345, Insufficient Verification of Data Authenticity. The exploitation technique maps directly to MITRE ATT&CK tactic T1098, Account Manipulation, particularly the sub-technique of SSH Host Key Manipulation or general account spoofing where an actor alters attributes associated with a user identity to evade detection or impersonate another entity. It also relates to T1496, Resource Hijacking, as the attacker can disrupt services by manipulating subscription states. To mitigate this risk, developers must implement strict server-side validation that binds every incoming message's source identifier to the authenticated session ID of the connecting client. The MOOSDB should reject any message where the declared sender does not match the identity established during the initial handshake and authentication phase. Additionally, implementing digital signatures for critical messages would provide an additional layer of integrity verification, ensuring that even if metadata is tampered with, the cryptographic proof of origin remains valid and verifiable by all participating nodes in the network.