CVE-2026-95848 in Moquette
Summary
by MITRE • 09/23/2026
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to AcceptAllAuthenticator or PermitAllAuthorizatorPolicy. A misspelled class name, missing dependency, constructor failure, or classpath problem can therefore start the broker with authentication or authorization disabled even though the operator configured those controls. This issue is fixed in version 0.18.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/23/2026
The Moquette MQTT broker, a lightweight Java-based implementation of the Message Queuing Telemetry Transport protocol, contains a critical security misconfiguration vulnerability affecting versions prior to 0.18.1. The core flaw resides within the server initialization logic, specifically in the methods responsible for loading custom authentication and authorization components. When an operator configures specific authenticator or authorizator classes via configuration files, the system attempts to dynamically load these Java classes at startup. However, if this loading process fails due to a misspelled class name, missing dependencies, constructor exceptions, or general classpath issues, the software does not abort with a fatal error indicating misconfiguration. Instead, it silently falls back to default implementations that effectively disable security controls. Specifically, the server initializes an AcceptAllAuthenticator and a PermitAllAuthorizatorPolicy, which allow any client to connect without credentials and grant them full access rights regardless of their identity or permissions.
This behavior creates a severe authentication bypass scenario where the presence of configuration directives implies that security is enforced, while the underlying runtime state actually permits unrestricted access. An attacker who can interact with the MQTT broker does not need to exploit complex code execution flaws; they simply rely on the operator's misconfiguration being silently ignored by the software. This results in a complete loss of confidentiality and integrity for any data transmitted through the broker, as unauthorized clients can subscribe to sensitive topics or publish malicious messages without restriction. The vulnerability is particularly dangerous because it masks itself as normal operation rather than raising an alarm that would alert system administrators to the security gap.
From a classification perspective, this issue aligns with CWE-287, which describes Improper Authentication, and CWE-269, indicating Improper Privilege Assignment. In terms of adversarial tactics, it facilitates initial access within the ATT&CK framework by allowing unauthenticated entities to gain entry into the system environment. The root cause is a failure in error handling during the initialization phase, where the application assumes that if custom classes cannot be loaded, no security measures were intended rather than treating this as a critical configuration error requiring immediate attention and service termination.
To mitigate this vulnerability, organizations must upgrade Moquette to version 0.18.1 or later, where the developers have corrected the initialization logic to fail securely when class loading errors occur. In environments running older versions that cannot be immediately patched, operators should rigorously validate their configuration files before deployment and monitor server logs for any warnings related to class loading failures. Additionally, implementing network-level access controls such as firewalls can provide a secondary layer of defense by restricting who can connect to the MQTT broker ports until the software is updated. Regular security audits that verify actual runtime behavior against configured policies are essential to detect similar silent fallback mechanisms in other components.