{"id":"CVE-2026-85724","title":"Moquette is a lightweight Java MQTT broker","summary":"Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then t…","severity":"critical","cvss":9.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cwe":["CWE-155","CWE-863"],"vendor":"moquette","product":"moquette","affected":["moquette < 0.18.1"],"patched":["moquette 0.18.1"],"published":"2026-09-23","updated":"2026-09-25","sourceUpdated":"2026-09-25T13:34:57.140","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85724","references":[{"url":"https://github.com/moquette-io/moquette/commit/b4a98bb3f3425ece476ed073aa080c627c1239af","label":"security-advisories@github.com"},{"url":"https://github.com/moquette-io/moquette/releases/tag/v0.18.1","label":"security-advisories@github.com"},{"url":"https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","label":"security-advisories@github.com"},{"url":"https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/moquette-io/moquette/pull/957"},{"url":"https://github.com/moquette-io/moquette/pull/958"},{"url":"https://github.com/moquette-io/moquette/pull/959"},{"url":"https://github.com/moquette-io/moquette/commit/14a2f4fd280c8f6a791600c306cbccecb7c67007"},{"url":"https://github.com/moquette-io/moquette/commit/26498631e92d50440b4e3ed42fa546253cc4090c"},{"url":"https://github.com/moquette-io/moquette/commit/72d6c8257191d2e4b2e3aa11ab25fd09f88c6cb7"},{"url":"https://github.com/moquette-io/moquette/commit/86feb7c31e6fac849c465d8079d08c0e7ef01cdf"},{"url":"https://github.com/moquette-io/moquette/commit/affdc71fdba92dc020421678970ae70518fb6da2"},{"url":"https://github.com/moquette-io/moquette/commit/c65b3e90fa03e562e2c2fa69c3ee916c2cbfbd2b"},{"url":"https://github.com/moquette-io/moquette/commit/ca17e0be19e86d5e291f4532dfdc94616c8e0049"},{"url":"https://github.com/moquette-io/moquette/commit/d77753542e262b7aa573dee3c2b05e44439bbd96"},{"url":"https://github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec6c96973"},{"url":"https://github.com/advisories/GHSA-5f42-97gr-vfhq"}],"tags":["nvd","cve.org","exploit-available","ghsa","maven"],"epss":0.00262,"epssPercentile":0.1604,"aliases":["GHSA-5f42-97gr-vfhq"],"ecosystem":"maven","exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-09-24T14:18:56.863679Z"},"ingestedAt":"2026-09-23T16:27:22.660Z","slug":"CVE-2026-85724","body":"## Overview\n\nMoquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses + or # in either identity can broaden the substituted filter and gain cross-tenant read and write access. A # identity can also produce an invalid filter that triggers a NullPointerException in Topic.match and disrupts session processing. This issue is fixed in version 0.18.1.\n\n## Affected\n\n- `moquette < 0.18.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `moquette 0.18.1`\n\n## Package advisory (CVE-2026-85724)\n\nAffected packages:\n\n- `io.moquette:moquette-broker <= 0.18.0`\n\nPatched in:\n\n- `io.moquette:moquette-broker 0.18.1`\n\nSource: https://github.com/advisories/GHSA-5f42-97gr-vfhq","depth":"abyssal","depthScore":65,"depthScoreParts":{"impact":52.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":210185,"id":"CVE-2026-85724","ts":1790264794721,"field":"exploit_available","old":"false","new":"true"}]}