DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-85724: CVE-2026-85724: Pattern-ACL Wildcard Injection & Cross-Tenant Authorization Bypass in Moquette MQTT Broker

#security #cve #cybersecurity

CVE-2026-85724: Pattern-ACL Wildcard Injection & Cross-Tenant Authorization Bypass in Moquette MQTT Broker

Vulnerability ID: CVE-2026-85724
CVSS Score: 9.6
Published: 2026-09-23

CVE-2026-85724 is a critical vulnerability in the Moquette MQTT broker (versions prior to 0.18.1) where unvalidated substitution of client identifiers and usernames into pattern-based Access Control Lists (ACLs) permits remote authenticated attackers to bypass multi-tenant boundaries and trigger a Denial of Service.

TL;DR

A critical flaw in Moquette versions < 0.18.1 allows remote clients to inject MQTT wildcards into their Client ID or username, bypassing pattern-based ACLs for cross-tenant topic access, or triggering a NullPointerException that silences the shared event loop and crashes the broker's session handling.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-863, CWE-155
  • Attack Vector: Network (Unauthenticated or Low-Privilege Remote)
  • CVSS v3.1 Score: 9.6 (Critical)
  • EPSS Score: N/A
  • Impact: Cross-Tenant Authorization Bypass & Denial of Service
  • Exploit Status: Proof of Concept / Code-Level Analysis
  • KEV Status: Not Listed in CISA KEV Catalog

Affected Systems

  • Moquette MQTT Broker versions prior to 0.18.1
  • Moquette: < 0.18.1 (Fixed in: 0.18.1)

Code Analysis

Commit: b4a98bb

Pattern ACL Wildcard Injection Patch

Commit: ffd9215

Guard for Null Username Reference

Commit: 86feb7c

Containment of Command/Thread Processing Exceptions

Mitigation Strategies

  • Upgrade the Moquette broker dependency to version 0.18.1 or higher.
  • Filter and reject connection requests containing wildcard characters (+ or #) at the reverse proxy or network gateway level.
  • Transition from dynamic pattern-based ACLs to static, explicit user-to-topic mapping rules.

Remediation Steps:

  1. Identify all deployed instances of the Moquette broker within the application infrastructure.
  2. Update the project build files (e.g., pom.xml or build.gradle) to point to version 0.18.1.
  3. Deploy the updated application to staging environments and verify that normal client communication works as expected.
  4. Verify that clients attempting to connect with '+' or '#' inside their client ID are blocked from matching pattern rules, and check that warnings are generated in the application logs.
  5. Roll out the patched application version across production systems.

References

Read the full report for CVE-2026-85724 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)