Java MQTT Broker Vulnerability in Moquette Affects Cross-Tenant Security
CVE-2026-85724

9.6CRITICAL

Key Information:

Vendor

Moquette-io

Status
Moquette
Vendor
CVE Published:
23 September 2026

What is CVE-2026-85724?

Moquette, a lightweight Java MQTT broker, has a security issue prior to version 0.18.1 where improperly configured pattern-based Access Control List (ACL) rules can lead to unintended access control. When %c or %u placeholders are used directly in rules, a client can manipulate its identity containing special characters like + or #, thus broadening the access granted and allowing cross-tenant read and write operations. This flaw may also result in an invalid MQTT topic filter causing a NullPointerException, potentially disrupting session processing. This critical issue highlights the necessity of properly securing client identities and upgrading to version 0.18.1 for a fix.

Affected Version(s)

moquette < 0.18.1

References

https://github.com/moquette-io/moquette/security/advisori...
x_refsource_CONFIRM
https://github.com/moquette-io/moquette/commit/b4a98bb3f3...
x_refsource_MISC
https://github.com/moquette-io/moquette/releases/tag/v0.18.1
x_refsource_MISC

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.