moquette-io Moquette up to 0.18.0 ACL Topic.match AuthorizationsCollector.canDoOperation client ID/username improper authorization

Summaryinfo

A vulnerability classified as critical was found in moquette-io Moquette up to 0.18.0. The affected element is the function AuthorizationsCollector.canDoOperation of the file Topic.match of the component ACL. Such manipulation of the argument client ID/username leads to improper authorization. This vulnerability is uniquely identified as CVE-2026-85724. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, has been found in moquette-io Moquette up to 0.18.0. Affected by this issue is the function AuthorizationsCollector.canDoOperation of the file Topic.match of the component ACL. The manipulation of the argument client ID/username with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses + or # in either identity can broaden the substituted filter and gain cross-tenant read and write access. A # identity can also produce an invalid filter that triggers a NullPointerException in Topic.match and disrupts session processing. This issue is fixed in version 0.18.1.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-85724 since 09/04/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1548.002.

Upgrading to version 0.18.1 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• moquette-io

Name

• Moquette

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18.0

Website

• Product: https://github.com/moquette-io/moquette/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion