CVE-2026-85724
Received Received - Intake

MQTT Broker ACL Bypass via Malicious Client ID

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses + or # in either identity can broaden the substituted filter and gain cross-tenant read and write access. A # identity can also produce an invalid filter that triggers a NullPointerException in Topic.match and disrupts session processing. This issue is fixed in version 0.18.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-85724
EUVD
EUVD-2026-85411

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
moquette moquette to 0.18.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-155 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as wildcards or matching symbols when they are sent to a downstream component.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Moquette, a lightweight Java MQTT broker. It involves pattern-based Access Control List (ACL) rules that improperly handle client IDs or usernames containing MQTT wildcard characters ('+' or '#'). When substituted into topic filters, these wildcards can broaden permissions, allowing unauthorized cross-tenant read and write access. A client ID of '#' can also cause a NullPointerException in Topic.match(), disrupting session processing.

Detection Guidance

To detect this vulnerability, monitor for clients using MQTT wildcards (+ or #) in client IDs or usernames. Check Moquette broker logs for NullPointerException errors in Topic.match() or unauthorized access attempts. Inspect ACL rule substitutions for improper topic filter generation.

Impact Analysis

An attacker could exploit this to gain unauthorized access to MQTT topics across tenants, read or write sensitive data, or crash the broker entirely. The impact includes confidentiality and integrity breaches, potential denial-of-service, and session disruption. Exploitation is possible without authentication due to default anonymous client connections.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Non-compliance risks include fines, legal penalties, and reputational damage due to breaches of confidentiality and integrity.

Mitigation Strategies

Upgrade Moquette to version 0.18.1 or later. Reject client IDs or usernames containing MQTT wildcards (+ or #). Implement strict ACL validation and disable anonymous connections if possible. Monitor for DoS attempts and enforce resource limits.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85724. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart