CVE-2026-85724: Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug
moquette is reachable by untrusted MQTT clients (anonymous by default), so every byte from any client, including pre-authentication, is untrusted. This is a memory-safe JVM: the ceiling is authorization/ACL bypass + denial of service + cross-session integrity, not RCE (I did not find one and do not claim one). Audited at commit da7f719a6bab9829d520b5838e13ea7b1f9be3ef, module broker/.
References
- github.com/advisories/GHSA-5f42-97gr-vfhq
- github.com/moquette-io/moquette/commit/14a2f4fd280c8f6a791600c306cbccecb7c67007
- github.com/moquette-io/moquette/commit/26498631e92d50440b4e3ed42fa546253cc4090c
- github.com/moquette-io/moquette/commit/72d6c8257191d2e4b2e3aa11ab25fd09f88c6cb7
- github.com/moquette-io/moquette/commit/86feb7c31e6fac849c465d8079d08c0e7ef01cdf
- github.com/moquette-io/moquette/commit/affdc71fdba92dc020421678970ae70518fb6da2
- github.com/moquette-io/moquette/commit/b4a98bb3f3425ece476ed073aa080c627c1239af
- github.com/moquette-io/moquette/commit/c65b3e90fa03e562e2c2fa69c3ee916c2cbfbd2b
- github.com/moquette-io/moquette/commit/ca17e0be19e86d5e291f4532dfdc94616c8e0049
- github.com/moquette-io/moquette/commit/d77753542e262b7aa573dee3c2b05e44439bbd96
- github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec6c96973
- github.com/moquette-io/moquette/pull/957
- github.com/moquette-io/moquette/pull/958
- github.com/moquette-io/moquette/pull/959
- github.com/moquette-io/moquette/releases/tag/v0.18.1
- github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq
- nvd.nist.gov/vuln/detail/CVE-2026-85724
Code Behaviors & Features
Detect and mitigate CVE-2026-85724 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →