Moquette CVE-2026-85058

Requires the broker to run with allow_anonymous=true (Moquette's default) so an unauthenticated client can connect, AND the operator to have configured topic write ACLs (an IAuthorizatorPolicy denying canWrite on some topics) - without a restrictive ACL there is no protection to bypass and no security impact. The attacker must set the ACL-protected topic as the Last Will Topic in the CONNECT packet and then trigger abnormal disconnection (e.g. TCP RST) rather than a clean DISCONNECT so the broker fires the Will. Affected versions are moquette-io:moquette < 0.18.1; limiting factors are the ACL-dependent configuration and that each event injects only a single attacker-controlled message (though repeatable by reconnecting).

CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) reflects a network-reachable, unauthenticated, low-complexity integrity-only flaw with no confidentiality or availability impact - consistent with CWE-862 missing authorization on the Last Will publish path. All exploitation signals point to a real but conditional bug rather than a widely-weaponized threat: no EPSS score is provided, KEV=NO (not in CISA KEV), and there is no public exploit code - only a vendor GHSA advisory with root-cause analysis and a regression test. The SSVC picture is: exploitation=none observed, automatable=yes (scriptable CONNECT-with-Will then TCP RST), technical impact=partial (single-topic integrity injection). The most important nuance the raw 7.5 hides is the gating: impact only materializes when the operator has configured write ACLs AND left allow_anonymous=true (the default); on brokers with no ACL policy there is nothing to bypass. Also note the I:H rating is generous - each abnormal disconnect injects one attacker-controlled Will message, so integrity impact per event is bounded (though repeatable via reconnection). Net: a legitimate authorization-bypass worth patching for ACL-dependent deployments, but real-world priority is tempered by niche product footprint, no active exploitation, and dependence on a specific ACL+anonymous configuration.

On a Moquette broker with allow_anonymous=true (default) and a write ACL protecting a sensitive topic (e.g. commands/actuator), an unauthenticated attacker opens a CONNECT specifying that restricted topic as the Last Will Topic with an attacker-chosen payload, then abruptly drops the TCP connection with an RST. The broker fires the Will through publishWill()→publish2Subscribers() without calling authorizator.canWrite(), delivering the forged message to all subscribers of the ACL-protected topic. No public exploit code is published, but the GHSA advisory documents the exact code path and ships a regression test demonstrating the behavior.