Moquette-Broker - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/moquette-broker/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 23 Sep 2026 19:56:44 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMultiple Security Vulnerabilities in Moquette MQTT Brokerhttps://feed.craftedsignal.io/briefs/2026-09-moquette-broker-vulnerabilities/Wed, 23 Sep 2026 19:56:44 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-moquette-broker-vulnerabilities/Moquette-broker versions <= 0.18.0 are susceptible to cross-tenant ACL bypass, remote unauthenticated denial-of-service, and cross-session durable storage corruption.Moquette-broker versions 0.18.0 and earlier contain multiple high-severity vulnerabilities resulting from inadequate validation of untrusted MQTT client input. The most critical issue (CVE-2026-85724) allows a remote unauthenticated attacker to bypass pattern-based ACLs by injecting wildcard characters (+, #) into the Client ID or username, leading to cross-tenant unauthorized data access and injection. Additional vulnerabilities include a remote unauthenticated denial-of-service (DoS) condition triggered by malformed MQTT packets such as $share subscriptions, which cause uncaught exceptions in the session event loop. Further issues include an authorization bypass for Will-message publications and a cross-session durable corruption bug stemming from H2 storage file collisions. These flaws present a significant risk in multi-tenant environments, as the broker does not sufficiently isolate sessions or validate input prior to processing.

Impact

Successful exploitation allows unauthenticated remote attackers to gain cross-tenant read and write access, crash the entire MQTT broker service, publish unauthorized Will-messages, or corrupt cross-session durable data. This affects any deployment utilizing pattern-based ACLs in a multi-tenant configuration, potentially leading to widespread information disclosure and service outages.

Recommendation

  1. Upgrade to a version of Moquette-broker that remediates CVE-2026-85724.
  2. Implement strict validation on Client ID and username fields during the MQTT CONNECT phase to reject input containing wildcard characters (+, #).
  3. Harden the SessionEventLoop to catch all Throwable exceptions and implement a robust supervision strategy to prevent broker-wide crashes.
  4. Enforce authorization checks for Will-message publications consistent with standard PUBLISH operations.
  5. Implement resource caps on connections, queues, and interceptor queues to mitigate OOM-based DoS risks.
  6. Ensure H2 persistent storage namespaces are appropriately separated to prevent ID collisions.
]]>criticaladvisorymqttbrokerauthentication-bypassdos