---
id: CVE-2026-95848
title: Moquette is a lightweight Java MQTT broker
summary: >-
  Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured
  authenticator or authorizator class cannot be loaded,
  Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat
  the failure as though no cu…
severity: critical
cvss: 9.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-636
vendor: moquette-io
product: moquette
affected:
  - moquette < 0.18.1
published: '2026-09-23'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T19:19:53.790'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-95848'
references:
  - url: >-
      https://github.com/moquette-io/moquette/commit/14a2f4fd280c8f6a791600c306cbccecb7c67007
    label: security-advisories@github.com
  - url: 'https://github.com/moquette-io/moquette/pull/967'
    label: security-advisories@github.com
  - url: 'https://github.com/moquette-io/moquette/releases/tag/v0.18.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq
    label: security-advisories@github.com
  - url: >-
      https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-09-23T17:58:35.511233Z'
cvssSource: cna
ingestedAt: '2026-09-23T17:28:14.852Z'
---

## Overview

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to AcceptAllAuthenticator or PermitAllAuthorizatorPolicy. A misspelled class name, missing dependency, constructor failure, or classpath problem can therefore start the broker with authentication or authorization disabled even though the operator configured those controls. This issue is fixed in version 0.18.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.