---
id: CVE-2026-95846
title: Moquette is a lightweight Java MQTT broker
summary: >-
  Moquette is a lightweight Java MQTT broker. Prior to 0.18.1,
  PostOffice.publishWill publishes a client's Last-Will message without applying
  the canWrite authorization and reserved-topic checks used for a normal
  PUBLISH. A client can conf…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-862
vendor: moquette
product: moquette
affected:
  - moquette < 0.18.1
patched:
  - moquette 0.18.1
published: '2026-09-23'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T13:34:02.580'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-95846'
references:
  - url: >-
      https://github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec6c96973
    label: security-advisories@github.com
  - url: 'https://github.com/moquette-io/moquette/releases/tag/v0.18.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq
    label: security-advisories@github.com
  - url: >-
      https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00288
epssPercentile: 0.19107
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-24T14:21:37.380771Z'
scores:
  nvd: 7.5
  cna: 8.7
ingestedAt: '2026-09-23T17:28:14.851Z'
---

## Overview

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to write and cause the broker to publish the unauthorized message when the client disconnects unexpectedly. This issue allows unauthorized message injection into restricted topics. This issue is fixed in version 0.18.1.

## Affected

- `moquette < 0.18.1`

## Remediation

Upgrade past the affected range:

- `moquette 0.18.1`