DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-85058: CVE-2026-85058: Missing Authorization in Moquette MQTT Broker Last Will and Testament Feature

#security #cve #cybersecurity

CVE-2026-85058: Missing Authorization in Moquette MQTT Broker Last Will and Testament Feature

Vulnerability ID: CVE-2026-85058
CVSS Score: 7.5
Published: 2026-09-18

An authorization bypass vulnerability exists in the Moquette MQTT broker prior to version 0.18.1. When an MQTT client registers a Last Will and Testament (LWT) topic during its connection setup, the broker fails to perform write-access checks on that topic. Upon an abrupt client disconnection, the broker publishes the registered Will message to subscribers of the unauthorized topic, bypassing configured Access Control Lists (ACLs).

TL;DR

Moquette MQTT broker versions before 0.18.1 fail to validate write permissions when executing a client's Last Will and Testament, enabling write-restricted or anonymous clients to publish to protected topics.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-862
  • Attack Vector: Network
  • CVSS v3.1 Score: 7.5 (High)
  • EPSS Score: Not Available
  • Impact: Integrity (High)
  • Exploit Status: PoC (Proof of Concept)
  • KEV Status: Not Listed

Affected Systems

  • Moquette MQTT Broker
  • io.moquette:moquette-broker
  • moquette-broker: < 0.18.1 (Fixed in: 0.18.1)

Code Analysis

Commit: f5a323f

Fix Last Will Testament authorized write vulnerability by introducing authorizator checks in publishWill method.

Commit: e23df01

Backport Last Will Testament authorization patch into core message routing flow.

Exploit Details

  • GitHub: Integration test WillUnauthorizedPublishTest.java validating and demonstrating the LWT authorization bypass mechanism.

Mitigation Strategies

  • Upgrade the Moquette broker dependency to version 0.18.1 or higher to apply the official authorization validation patch.
  • Disable anonymous connection permissions within the broker configuration to ensure all clients are authenticated before session registration.
  • Enforce network-level monitoring to detect rapid connection establishment and unexpected terminations designed to trigger LWT publications.

Remediation Steps:

  1. Identify all deployment instances of the io.moquette:moquette-broker dependency within the environment.
  2. Update the project build files (e.g., pom.xml or build.gradle) to reference version 0.18.1 or a newer release.
  3. Audit custom access control implementations to confirm how the static client identity 'WILL_PUBLISHER' and empty usernames are processed.
  4. Verify the configuration of the broker to ensure 'allow_anonymous' is set to 'false' if anonymous connections are not business-critical.
  5. Redeploy the updated broker application and verify that connection termination tests do not result in unauthorized topic writes.

References

Read the full report for CVE-2026-85058 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)