---
id: CVE-2026-85724
title: Moquette is a lightweight Java MQTT broker
summary: >-
  Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when
  pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation
  substitutes client ID and username values directly into rules containing %c or
  %u and then t…
severity: critical
cvss: 9.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N'
cwe:
  - CWE-155
  - CWE-863
vendor: moquette
product: moquette
affected:
  - moquette < 0.18.1
patched:
  - moquette 0.18.1
published: '2026-09-23'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T13:34:57.140'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85724'
references:
  - url: >-
      https://github.com/moquette-io/moquette/commit/b4a98bb3f3425ece476ed073aa080c627c1239af
    label: security-advisories@github.com
  - url: 'https://github.com/moquette-io/moquette/releases/tag/v0.18.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq
    label: security-advisories@github.com
  - url: >-
      https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/moquette-io/moquette/pull/957'
  - url: 'https://github.com/moquette-io/moquette/pull/958'
  - url: 'https://github.com/moquette-io/moquette/pull/959'
  - url: >-
      https://github.com/moquette-io/moquette/commit/14a2f4fd280c8f6a791600c306cbccecb7c67007
  - url: >-
      https://github.com/moquette-io/moquette/commit/26498631e92d50440b4e3ed42fa546253cc4090c
  - url: >-
      https://github.com/moquette-io/moquette/commit/72d6c8257191d2e4b2e3aa11ab25fd09f88c6cb7
  - url: >-
      https://github.com/moquette-io/moquette/commit/86feb7c31e6fac849c465d8079d08c0e7ef01cdf
  - url: >-
      https://github.com/moquette-io/moquette/commit/affdc71fdba92dc020421678970ae70518fb6da2
  - url: >-
      https://github.com/moquette-io/moquette/commit/c65b3e90fa03e562e2c2fa69c3ee916c2cbfbd2b
  - url: >-
      https://github.com/moquette-io/moquette/commit/ca17e0be19e86d5e291f4532dfdc94616c8e0049
  - url: >-
      https://github.com/moquette-io/moquette/commit/d77753542e262b7aa573dee3c2b05e44439bbd96
  - url: >-
      https://github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec6c96973
  - url: 'https://github.com/advisories/GHSA-5f42-97gr-vfhq'
tags:
  - nvd
  - cve.org
  - exploit-available
  - ghsa
  - maven
epss: 0.00262
epssPercentile: 0.1604
aliases:
  - GHSA-5f42-97gr-vfhq
ecosystem: maven
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-24T14:18:56.863679Z'
ingestedAt: '2026-09-23T16:27:22.660Z'
---

## Overview

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses + or # in either identity can broaden the substituted filter and gain cross-tenant read and write access. A # identity can also produce an invalid filter that triggers a NullPointerException in Topic.match and disrupts session processing. This issue is fixed in version 0.18.1.

## Affected

- `moquette < 0.18.1`

## Remediation

Upgrade past the affected range:

- `moquette 0.18.1`

## Package advisory (CVE-2026-85724)

Affected packages:

- `io.moquette:moquette-broker <= 0.18.0`

Patched in:

- `io.moquette:moquette-broker 0.18.1`

Source: https://github.com/advisories/GHSA-5f42-97gr-vfhq