Authentication Bypass in Moquette MQTT Broker Versions Affected

CVE-2026-85058

What is CVE-2026-85058?

Moquette, a lightweight Java MQTT broker, has a vulnerability in prior versions to 0.18.1 where the PostOffice.publishWill method can lead to unauthorized message publishing. This occurs as the method publishes client-controlled Last Will messages without running necessary authorization checks. If anonymous access is enabled and topic Access Control Lists (ACLs) are set, a malicious remote client could define an ACL-protected topic as their Last Will message and subsequently use abnormal disconnections to inject malicious messages. This flaw compromises message integrity and security, allowing potential exploitation of systems dependent on the MQTT protocol.

References