Moquette CVE-2026-95846

Exploitation requires that the broker enforces topic write authorization (an IAuthorizatorPolicy/ACL is configured to restrict PUBLISH to certain topics) - the bug only matters where such an ACL boundary exists to be bypassed; on a fully permissive broker there is nothing to escape. The attacker must (1) be able to connect (trivial: Moquette accepts anonymous clients by default), (2) set a Last-Will Testament targeting a restricted topic during CONNECT, and (3) trigger an unexpected/abrupt disconnect (attacker-controlled, e.g. dropping the TCP socket). No authentication, user interaction, or non-default configuration beyond having ACLs enabled is required. The limiting factor is purely that the injected message goes only to subscribers of the chosen restricted topic - impact scales with how security-sensitive those topics are (e.g. device command/control channels).

The vendor CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N with VI:H, all other impacts N) frames this as a network-reachable, unauthenticated, integrity-only flaw - consistent with the description: a Last-Will message is published via PostOffice.publishWill without the canWrite/reserved-topic checks applied to a normal PUBLISH, so a client can inject messages into topics it is not authorized to write. Because Moquette accepts anonymous clients by default and the attacker fully controls the disconnect that triggers the Will, PR:N and AC:L are defensible; the abuse channel is trivially reachable. There is no confidentiality or availability impact (VC:N/VA:N), so this is a targeted integrity/authorization-bypass issue rather than a full compromise - CWE-862 (missing authorization), NOT authentication bypass or RCE (the source-code advisory explicitly disclaims RCE on this memory-safe JVM). No EPSS score, no CISA KEV listing, and no independent evidence of active exploitation are present in the input, so real-world exploitation pressure is unquantified; however, a source-only proof-of-concept (the WillUnauthorizedPublishTest regression test and advisory PoCs) demonstrates the flaw concretely. Net: a real, credible authorization-bypass bug worth patching, but its practical impact hinges on whether the deployment relies on topic ACLs to enforce a security boundary - where it does (multi-tenant/IoT command topics), integrity risk is genuine; where ACLs are cosmetic, impact is limited.

An attacker connects to a Moquette broker (anonymous by default) and sets a Last-Will topic pointing at a restricted topic it has no write permission for - e.g. a control/command topic subscribed to by IoT actuators or other tenants. The attacker then abruptly drops the connection, causing the broker to publish the crafted Will payload to that protected topic, bypassing the ACL. A source-only proof-of-concept regression test (WillUnauthorizedPublishTest, per GHSA-9jjc-fw8x-fmwx) confirms the behavior; exploitation is remote and requires no authentication or user interaction.