CVE-2026-85724
Description
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses + or # in either identity can broaden the substituted filter and gain cross-tenant read and write access. A # identity can also produce an invalid filter that triggers a NullPointerException in Topic.match and disrupts session processing. This issue is fixed in version 0.18.1.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
Propose a mitigation on Community Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Maven | io.moquette:moquette-broker | <0.18.1 | 0.18.1 |
References
- https://github.com/moquette-io/moquette/commit/b4a98bb3f3425ece476ed073aa080c627c1239af
- https://github.com/moquette-io/moquette/releases/tag/v0.18.1
- https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq
- https://github.com/moquette-io/moquette/pull/957
- https://github.com/moquette-io/moquette/pull/958
- https://github.com/moquette-io/moquette/pull/959
- https://github.com/moquette-io/moquette/commit/14a2f4fd280c8f6a791600c306cbccecb7c67007
- https://github.com/moquette-io/moquette/commit/26498631e92d50440b4e3ed42fa546253cc4090c
- https://github.com/moquette-io/moquette/commit/72d6c8257191d2e4b2e3aa11ab25fd09f88c6cb7
- https://github.com/moquette-io/moquette/commit/86feb7c31e6fac849c465d8079d08c0e7ef01cdf
- https://github.com/moquette-io/moquette/commit/affdc71fdba92dc020421678970ae70518fb6da2
- https://github.com/moquette-io/moquette/commit/c65b3e90fa03e562e2c2fa69c3ee916c2cbfbd2b
- https://github.com/moquette-io/moquette/commit/ca17e0be19e86d5e291f4532dfdc94616c8e0049
- https://github.com/moquette-io/moquette/commit/d77753542e262b7aa573dee3c2b05e44439bbd96
- https://github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec6c96973
- https://github.com/moquette-io/moquette
CWEs
CWE-155 CWE-863
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.