Moquette MQTT Broker CVE-2026-95847

Requires the broker to use DURABLE/persistent sessions backed by the H2 MVStore (H2PersistentQueue) - the vulnerable code path only exists for durable queues. The attacker must connect a durable session using a client ID ending in '_meta' that matches a real victim's client ID (i.e., '<victim>_meta'), so knowledge or predictability of a target client ID is required. Moquette accepts anonymous clients by default (PR:N), so authentication is not necessarily needed, but the collision only yields cross-session impact when two durable sessions with the colliding names coexist. Deployments without H2 durable persistence, or single-tenant setups where no meaningful victim client ID can be targeted, are not exploitable.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L, 8.8) frames this as a network, unauthenticated, integrity-dominant flaw, which aligns with Moquette accepting anonymous MQTT clients by default. However, several signals temper the 8.8 rating. First, exploitation is materially gated: it only affects DURABLE (persistent) sessions backed by the H2 MVStore, and the attacker must connect with a client ID of the form '<victim>_meta' - meaning the attacker needs to know or guess a legitimate victim's client ID whose derived map name it can collide with. That is a real attack requirement not reflected by AC:L/AT:N, so I assess higher complexity (AC:H / AT:P). Second, the vendor set VC:N, yet the description explicitly states the collision can cause 'exposure of queued content across sessions,' which is a confidentiality impact - so VC:N appears understated and I assess VC:L. There is no EPSS score, no CISA KEV listing, and no independent active-exploitation evidence, so this is not a widespread-exploitation priority. Reproduction/exploit code effectively exists (the security advisory ships source-only PoCs run on JDK 17, and the fix PR adds a unit test that directly reproduces the map collision), so treat it as 'publicly available exploit code exists' rather than actively exploited. Net: a legitimate integrity/data-corruption and limited cross-session disclosure bug worth patching for anyone running durable H2 persistence in a multi-tenant broker, but not an internet-wide emergency given the niche product footprint and the durable-session precondition.

A multi-tenant Moquette deployment uses durable (persistent) sessions with H2 persistence. An attacker connects anonymously with a durable session whose client ID is '<victimClientId>_meta'; its message map ('queue_<victim>_meta') then aliases the victim's metadata map ('queue_<victim>_meta'), corrupting the victim's queue head/tail and causing message loss, misdelivery, failed queue reloads, or leakage of the victim's queued messages into the attacker's session. The GHSA advisory provides source-only PoCs (JDK 17) and the fix PR includes a unit test that reproduces the exact collision.