---
title: "CVE-2026-85724: Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug"
url: https://erroneo.us/security/cve/CVE-2026-85724/
description: "CVE-2026-85724 (io.moquette:moquette-broker (Maven)): Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-09-23
date_modified: 2026-10-19
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-85724"
kev: false
cvss: 9.6
epss: 0.0027
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-85724: Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug

**Signal:** Critical, preconditions apply. Severe if exploited, but exploitation needs conditions that may not apply to you. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Not in CISA KEV , but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 0.3% , percentile 18: FIRST’s model estimates a 0.3% chance of exploitation activity in the next 30 days, higher than 18% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Needs an account (low (any account)). Exposure depends on who can log in.
- Only applies if your dependency tree includes io.moquette:moquette-broker (Maven) <= 0.18.0, fixed in 0.18.1 . Check your lockfile, including transitive dependencies.

## What it is

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses + or # in either identity can broaden the substituted filter and gain cross-tenant read and write access. A # identity can also produce an invalid filter that triggers a NullPointerException in Topic.match and disrupts session processing. This issue is fixed in version 0.18.1.

## Affected packages

- Maven `io.moquette:moquette-broker` <= 0.18.0 → fixed: 0.18.1

## Affected products (CVE record)

- moquette-io moquette: < 0.18.1

## Severity

- GitHub_M CVSS 3.1: 9.6 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N`
- GitHub CVSS 3.1: 9.6 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 0.27% probability of exploitation activity in the next 30 days; percentile 18.

## Sources

- [GitHub Advisory GHSA-5f42-97gr-vfhq](https://github.com/advisories/GHSA-5f42-97gr-vfhq)
- [CVE.org record CVE-2026-85724](https://www.cve.org/CVERecord?id=CVE-2026-85724)
- [NVD entry CVE-2026-85724](https://nvd.nist.gov/vuln/detail/CVE-2026-85724)
- [github.com](https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq)
- [github.com](https://github.com/moquette-io/moquette/commit/b4a98bb3f3425ece476ed073aa080c627c1239af)
- [github.com](https://github.com/moquette-io/moquette/releases/tag/v0.18.1)
- [github.com](https://github.com/moquette-io/moquette/pull/957)
- [github.com](https://github.com/moquette-io/moquette/pull/958)
- [github.com](https://github.com/moquette-io/moquette/pull/959)
- [github.com](https://github.com/moquette-io/moquette/commit/14a2f4fd280c8f6a791600c306cbccecb7c67007)
- [github.com](https://github.com/moquette-io/moquette/commit/26498631e92d50440b4e3ed42fa546253cc4090c)
- [github.com](https://github.com/moquette-io/moquette/commit/72d6c8257191d2e4b2e3aa11ab25fd09f88c6cb7)
- [github.com](https://github.com/moquette-io/moquette/commit/86feb7c31e6fac849c465d8079d08c0e7ef01cdf)
- [github.com](https://github.com/moquette-io/moquette/commit/affdc71fdba92dc020421678970ae70518fb6da2)
- [github.com](https://github.com/moquette-io/moquette/commit/c65b3e90fa03e562e2c2fa69c3ee916c2cbfbd2b)
- [github.com](https://github.com/moquette-io/moquette/commit/ca17e0be19e86d5e291f4532dfdc94616c8e0049)
- [github.com](https://github.com/moquette-io/moquette/commit/d77753542e262b7aa573dee3c2b05e44439bbd96)
- [github.com](https://github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec6c96973)

---
Source page: https://erroneo.us/security/cve/CVE-2026-85724/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt