EUVD-2026-85411
GHSA-5f42-97gr-vfhq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConnect as anonymous/low-priv MQTT client
-
DeliverySend CONNECT with wildcard clientId (e.g. +)
-
ExploitWildcard substituted raw into pattern ACL
-
ExecutionACL match grants cross-tenant scope
-
PersistSubscribe/publish to other tenants' topics
-
ImpactCross-tenant eavesdropping and injection
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Wildcard neutralization
|
| Exploitation Conditions | The critical cross-tenant ACL bypass requires that the broker be configured with |
| Impact | The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, base 9.6) reflects the headline issue - a pattern-ACL wildcard-injection that yields cross-tenant read AND write (S:C, C:H, I:H). Real-world risk is materially shaped by preconditions the raw score hides: the critical ACL bypass only applies when |
| Exploit ScenarioDerived | In a multi-tenant moquette deployment using pattern ACLs (e.g. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Cross-tenant authorization bypass combined with pre-authentication denial of service in Moquette Broker 0.18.0 and earlier lets unauthenticated remote MQTT clients read and write other tenants' topics and repeatedly wedge or exhaust the broker. The critical flaw is wildcard injection through pattern-based ACLs that substitute %c/%u with an unvalidated clientId, so a client connecting with clientId '+' turns a rule such as sensor/%c/
into the filter sensor/+/#; from the same unauthenticated position an attacker can also trigger a $share/grp SUBSCRIBE StringIndexOutOfBoundsException, a StackOverflowError on deeply nested topics, an ACL NPE, unauthorized Will-message publishes, and unbounded subscription/retained/interceptor state that causes memory or disk exhaustion. Publicly available exploit code exists in the form of source-only PoCs (JDK 17) for the pattern-ACL bypass, the shared-subscription crash, and the H2 metadata collision; the vendor-released fix is 0.18.1, and no CISA KEV entry or confirmed in-the-wild exploitation was provided. Score of 9.6 reflects scope change with high confidentiality and integrity impact, gated on a multi-tenant pattern-ACL configuration for the worst outcome.
RemediationAI
Vendor-released patch: 0.18.1 - upgrade io.moquette:moquette-broker to 0.18.1 (release tag v0.18.1, see https://github.com/moquette-io/moquette/releases/tag/v0.18.1), which incorporates the fixes in PRs 957 (SessionEventLoop now catches Throwable so a failing command no longer kills the shared loop), 958, and 959 and the associated commits (14a2f4fd, 26498631, 72d6c825, 86feb7c3, affdc71f, b4a98bb3, c65b3e90, ca17e0be, d7775354, f5a323fe), with full details in the advisory https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq. If an immediate upgrade is impossible, apply the following compensating controls in order of value: reject any CONNECT whose clientId or username contains '+'/'#' (strongest single control - it kills the pattern-ACL wildcard injection and the clientId-'#' ACL NPE, at the cost of breaking clients that legitimately use those characters in their identifiers); eliminate or rewrite pattern ACLs that interpolate %c/%u into topics that are then wildcard-matched, or convert them to exact-match rules (removes the cross-tenant read/write vector but requires per-client ACL maintenance); disable anonymous access and require authentication, which removes pre-authentication reachability of the $share/grp crash, nested-topic StackOverflow, and unbounded-state OOM paths (may break unauthenticated IoT fleets); add a broker-side filter validator rejecting malformed $share/grp and over-deep topic trees at the front door; enforce resource caps on subscriptions, retained messages, in-flight windows, topic aliases, and the broker interceptor queue together with bounded session expiry (prevents OOM/disk exhaustion but caps legitimate high-fan-out clients); and, for deployments using H2 durable storage, isolate or escape the queue_<clientId> namespace so metadata maps cannot collide (note this requires a code change - the vendor fix is the reliable path). Do not rely on network segmentation alone, since the broker port itself is the attack surface; monitor for CONNECT attempts containing MQTT wildcard characters and for repeated broker session-loop stalls as detection signals for exploitation attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Moquette is a Java (memory-safe JVM) MQTT 3.1.1/5 broker distributed as the Maven artifact pkg:maven/io.moquette:moquette-broker; because it accepts anonymous clients by default, every byte arriving on the wire - including pre-authentication CONNECT and SUBSCRIBE packets - is untrusted. In AuthorizationsCollector.canDoOperation (AuthorizationsCollector.java:116-131, line 123) the broker builds the rule topic via auth.topic.toString().replace("%c", client).replace("%u", username) and then calls topic.match(substitutedTopic); the clientId is never validated for MQTT wildcard metacharacters '+' and '#' at MQTTConnection.processConnect, so the substitution semantics are inverted - attacker-controlled wildcards expand the rule instead of being expanded by it. The root cause class is improper neutralization of special elements in an authorization decision (ACL wildcard injection leading to authz bypass), compounded by uncaught-exception handling defects: SessionEventLoop (SessionEventLoop.java:40-54) catches only InterruptedException and is never restarted by SessionEventLoopGroup, so any Throwable on that shared loop permanently wedges every co-located session. Reachable throwables include SharedSubscriptionUtils.extractShareName on a malformed $share/grp filter, recursive CTrie descent on deeply nested topics, and a null-token NPE in Topic.match (Topic.java:173) when clientId '#' produces an invalid filter such as sensor/#/#. Additional root causes include missing canWrite/reserved-topic checks on Last-Will publication in PostOffice.publishWill, H2PersistentQueue namespace collisions from unescaped queue_"+clientId and queue_"+clientId+"_meta keys (client id 'sensor_meta' aliasing a victim's metadata map and corrupting head/tail), an unbounded BrokerInterceptor queue, and fail-open behavior in Server.java:483-531 where a custom authenticator/authorizator class that fails to load degrades to PermitAll/AcceptAll. No CWE identifier was supplied in the source data; the analyst characterization above maps the issues to authorization-bypass, uncaught-exception/DoS, and integrity-corruption classes. The author explicitly states no RCE was found and none is claimed: the impact ceiling on this JVM is authorization/ACL bypass, denial of service, and cross-session integrity.
Know when Java gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Anonymous-by-default access justifies PR:N; cross-tenant reach gives S:C with C:H/I:H, and the documented pre-auth whole-broker crash warrants A:H (vendor's A:N understates it).
Primary rating from Vendor (https://github.com/moquette-io/moquette).
CVSS VectorVendor: https://github.com/moquette-io/moquette
DescriptionCVE.org
moquette is reachable by untrusted MQTT clients (anonymous by default), so every byte from any client, including pre-authentication, is untrusted. This is a memory-safe JVM: the ceiling is authorization/ACL bypass + denial of service + cross-session integrity, not RCE (I did not find one and do not claim one). Audited at commit da7f719a6bab9829d520b5838e13ea7b1f9be3ef, module broker/.
What a connecting client can do
- (Critical) Bypass
pattern-based ACLs across tenants. InAuthorizationsCollector.canDoOperation(AuthorizationsCollector.java:116-131, esp. line 123) the clientId/username is substituted raw into a pattern ACL rule and then wildcard-matched, and the clientId is never validated for MQTT wildcard characters +/
at CONNECT (MQTTConnection.processConnect):
Topic substitutedTopic = new Topic(auth.topic.toString().replace("%c", client).replace("%u", username)); if (topic.match(substitutedTopic)) return true;
A client that connects with clientId + turns sensor/%c/
into the filter sensor/+/#, gaining cross-tenant read AND write. (Precondition: pattern ACL rules configured - a common multi-tenant setup.)
- (High) Crash the whole broker. SessionEventLoop (SessionEventLoop.java:40-54) catches only InterruptedException and is never restarted (SessionEventLoopGroup), so any uncaught exception on it wedges every co-located client. Trivially reachable inputs: malformed $share/grp SUBSCRIBE (SharedSubscriptionUtils.extractShareName -> StringIndexOutOfBoundsException), deeply nested topic (CTrie recursion -> StackOverflowError), and ACL NPE below. Unbounded subscriptions / retained / in-flight / topic-alias / interceptor state (BrokerInterceptor uses an unbounded queue) also allow OOM; durable stores allow disk exhaustion.
- (High) NPE in ACL sink on clientId
(invalid filter sensor/#/
-> null tokens -> Topic.match NPE at Topic.java:173).
- (High) Will-message authorization bypass. Last-Will topic is published (PostOffice.publishWill) without canWrite/reserved-topic checks used for normal PUBLISH.
- (Medium) Cross-session durable corruption. H2PersistentQueue opens queue_"+clientId and queue_"+clientId+"_meta; client id sensor_meta collides with victim sensor metadata map -> corrupts head/tail.
- (Medium) Fail-open if authenticator/authorizator class fails to load -> PermitAll/AcceptAll (Server.java:483-531).
Proof of concept
Source-only, no network; PoCs run on JDK 17:
- PoCPatternAcl - clientId + gains cross-tenant read/write; clientId
triggers NPE
- PoCSharedSubCrash - extractShareName("$share/grp") throws StringIndexOutOfBoundsException
- PoCMapCollision - H2 MVStore collision overwrites victim metadata pointer
Impact
Cross-tenant eavesdropping and injection, whole-broker DoS, unauthorized Will publishes, and cross-session durable corruption.
Remediation
- Reject clientId/username containing +/
(and / if structural) at CONNECT; expand %c/%u as literal tokens.
- Harden SessionEventLoop (catch Throwable + restart supervision) and validate $share filters.
- Apply authorization to Will publishes like normal PUBLISH.
- Add resource caps (connections, queues, retained, aliases, interceptor queue) + bounded session expiry.
- Separate H2 namespaces and fail closed on auth-class load failure.
Articles & Coverage 1
Technical POC Analysis
CWE-155, Improper Neutralization of Wildcards or Matching Symbols.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
Moquette Broker 0.18.0 and earlier - the MQTT backbone for tenant-facing messaging in affected deployments - allows a single remote client to cross tenant boundaries, reading and writing other tenants' topics while repeatedly degrading or exhausting the broker itself. Because publicly available exploit code exists, the gap between disclosure and attempted abuse is short, and the blast radius spans every tenant on a shared broker rather than an isolated account, making customer data confidentiality and service availability the primary business exposures. Leadership should treat this as a near-term remediation priority anywhere a multi-tenant Moquette broker is reachable by external or lower-trust clients.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Exploit-DB