{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/broker/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:moquette_broker:moquette_broker:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.6,"id":"CVE-2026-85724"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["moquette-broker (\u003c= 0.18.0)"],"_cs_severities":["critical"],"_cs_tags":["mqtt","broker","authentication-bypass","dos"],"_cs_type":"advisory","_cs_vendors":["moquette-broker"],"content_html":"\u003cp\u003eMoquette-broker versions 0.18.0 and earlier contain multiple high-severity vulnerabilities resulting from inadequate validation of untrusted MQTT client input. The most critical issue (CVE-2026-85724) allows a remote unauthenticated attacker to bypass pattern-based ACLs by injecting wildcard characters (+, #) into the Client ID or username, leading to cross-tenant unauthorized data access and injection. Additional vulnerabilities include a remote unauthenticated denial-of-service (DoS) condition triggered by malformed MQTT packets such as $share subscriptions, which cause uncaught exceptions in the session event loop. Further issues include an authorization bypass for Will-message publications and a cross-session durable corruption bug stemming from H2 storage file collisions. These flaws present a significant risk in multi-tenant environments, as the broker does not sufficiently isolate sessions or validate input prior to processing.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to gain cross-tenant read and write access, crash the entire MQTT broker service, publish unauthorized Will-messages, or corrupt cross-session durable data. This affects any deployment utilizing pattern-based ACLs in a multi-tenant configuration, potentially leading to widespread information disclosure and service outages.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade to a version of Moquette-broker that remediates CVE-2026-85724.\u003c/li\u003e\n\u003cli\u003eImplement strict validation on Client ID and username fields during the MQTT CONNECT phase to reject input containing wildcard characters (+, #).\u003c/li\u003e\n\u003cli\u003eHarden the SessionEventLoop to catch all Throwable exceptions and implement a robust supervision strategy to prevent broker-wide crashes.\u003c/li\u003e\n\u003cli\u003eEnforce authorization checks for Will-message publications consistent with standard PUBLISH operations.\u003c/li\u003e\n\u003cli\u003eImplement resource caps on connections, queues, and interceptor queues to mitigate OOM-based DoS risks.\u003c/li\u003e\n\u003cli\u003eEnsure H2 persistent storage namespaces are appropriately separated to prevent ID collisions.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-23T19:56:44Z","date_published":"2026-09-23T19:56:44Z","id":"https://feed.craftedsignal.io/briefs/2026-09-moquette-broker-vulnerabilities/","summary":"Moquette-broker versions \u003c= 0.18.0 are susceptible to cross-tenant ACL bypass, remote unauthenticated denial-of-service, and cross-session durable storage corruption.","title":"Multiple Security Vulnerabilities in Moquette MQTT Broker","url":"https://feed.craftedsignal.io/briefs/2026-09-moquette-broker-vulnerabilities/"}],"language":"en","title":"CraftedSignal Threat Feed - Broker","version":"https://jsonfeed.org/version/1.1"}