CVE-2026-85058High· 7.5▾ MidnightPoC availableMoquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers without invoking the authorizator.canWrite check used by normal PUBLISH paths…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Exploit / PoC code exists
Last analysed / modified upstream
0.3% → 0.5%
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers without invoking the authorizator.canWrite check used by normal PUBLISH paths. When anonymous access is enabled and topic ACLs restrict writes, a remote client can set an ACL-protected topic as the Last Will Topic during CONNECT and perform an abnormal client disconnect, causing the broker to inject attacker-controlled messages into a topic for which the client lacks write permission. This issue is fixed in version 0.18.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
io.moquette:moquette-broker < 0.18.1Patched in:
io.moquette:moquette-broker 0.18.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-95846High· 7.5Moquette is a lightweight Java MQTT broker
CVE-2026-85724Critical· 9.6Moquette is a lightweight Java MQTT broker
CVE-2026-95848Critical· 9.1Moquette is a lightweight Java MQTT broker
CVE-2026-95847High· 7.5Moquette is a lightweight Java MQTT broker
CVE-2026-95844High· 7.5Moquette is a lightweight Java MQTT broker
CVE-2026-95843High· 7.5Moquette is a lightweight Java MQTT broker