Authentication Bypass in MOOSDB HTTP Server by MOOS Core-MOOS
CVE-2026-85428

9.3CRITICAL

Key Information:

Vendor

Themoos

Status
Core-moos
Vendor
CVE Published:
3 September 2026

What is CVE-2026-85428?

The MOOS Core-MOOS through version 10.4.0 is impacted by an authentication bypass vulnerability in the optional MOOSDB HTTP server. This flaw allows unauthenticated clients to send HTTP requests to write variables, potentially including actuator commands and override commands. Attackers can manipulate system behavior without proper authentication due to this vulnerability, leading to significant security concerns.

Affected Version(s)

core-moos 0 <= 10.4.0

References

https://github.com/themoos/core-moos/pull/77
issue-trackingpatch
https://github.com/themoos/core-moos/commit/7e3aecdbf5fe4...
patch
https://github.com/themoos/core-moos
product

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Vlatko Kosturjak
.