CVE-2026-95846
Received Received - Intake

Unauthorized Will Message Injection in Moquette MQTT Broker

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to write and cause the broker to publish the unauthorized message when the client disconnects unexpectedly. This issue allows unauthorized message injection into restricted topics. This issue is fixed in version 0.18.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-95846
EUVD
EUVD-2026-85416

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
moquette moquette 0.18.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Moquette MQTT broker allows a client to set a Last-Will message for a topic they are not authorized to publish to. When the client disconnects unexpectedly, the broker publishes this unauthorized message to the restricted topic, potentially injecting messages into areas they should not access.

Impact Analysis

An attacker could exploit this to send unauthorized messages to restricted topics, potentially disrupting services, leaking sensitive data, or causing unintended actions in systems relying on MQTT for communication.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or manipulation, violating confidentiality and integrity requirements in GDPR and HIPAA. Compliance may be compromised if sensitive data is leaked or altered through unauthorized MQTT messages.

Mitigation Strategies

Upgrade Moquette to version 0.18.1 or later to apply the security fix that enforces authorization checks for Last-Will messages.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95846. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart