Access Control Flaw in NanoMQ Affects MQTT Messaging
CVE-2024-42655

8.8HIGH

Key Information:

Vendor

NanoMQ

Status
NanoMQ
Vendor
CVE Published:
29 July 2025

What is CVE-2024-42655?

An access control flaw in NanoMQ v0.21.10 exposes sensitive system topic messages to unauthorized access. Attackers can leverage MQTT wildcard characters to bypass established security measures, compromising the integrity of critical data streams. This vulnerability presents significant risks to systems that rely on NanoMQ for secure message communication, highlighting the need for immediate attention and remediation.

References

https://github.com/nanomq/nanomq
https://github.com/nanomq/nanomq/issues/1782#issuecomment...
https://github.com/songxpu/bug_report/blob/master/MQTT/Na...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.