CVE-2026-85058: Moquette MQTT Broker Auth Bypass Vulnerability

CVE-2026-85058 Overview

CVE-2026-85058 is a missing authorization vulnerability [CWE-862] in Moquette, a lightweight Java MQTT broker. Versions prior to 0.18.1 fail to enforce topic-level Access Control List (ACL) checks when publishing a client-controlled Last Will and Testament (LWT) message. The PostOffice.publishWill routine calls publish2Subscribers directly without invoking the authorizator.canWrite check applied on normal PUBLISH paths. When anonymous access is enabled and ACLs restrict writes, a remote attacker can register an ACL-protected topic as their Last Will Topic during CONNECT, then trigger an abnormal disconnect to inject attacker-controlled messages into topics they cannot legitimately write to.

Critical Impact
Remote unauthenticated attackers can bypass MQTT topic ACLs to inject arbitrary messages into restricted topics, undermining integrity of MQTT-driven IoT and messaging workflows.

Affected Products

Moquette MQTT broker versions prior to 0.18.1
Deployments with anonymous access enabled and topic-based ACL restrictions
Java-based MQTT messaging infrastructure using Moquette as broker

Discovery Timeline

2026-09-18 - CVE-2026-85058 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-85058

Vulnerability Analysis

Moquette is a Java implementation of an MQTT broker that supports pluggable authorization for topic-level publish and subscribe operations. The MQTT protocol permits clients to register a Last Will and Testament message at CONNECT time. The broker publishes this message on the client's behalf if the client disconnects abnormally.

In versions prior to 0.18.1, the PostOffice.publishWill method builds the will message and passes it directly to publish2Subscribers. This code path never consults the configured authorizator. As a result, the same topic that would be blocked in a standard PUBLISH operation is accepted and dispatched to subscribers when delivered as a Last Will. The bypass requires no authentication when the broker is configured with anonymous access, matching the network attack vector with no privileges required.

Root Cause

The root cause is a missing authorization check [CWE-862] on a secondary message-publish code path. The canWrite predicate that gates every normal client PUBLISH was omitted from the Last Will publish routine. The ACL layer therefore only enforces write restrictions for one of two message ingress points, leaving Last Will delivery as an unguarded channel into any topic.

Attack Vector

An attacker connects to the broker over the network and issues a CONNECT packet specifying a Will Topic that targets an ACL-protected topic and a Will Payload of their choice. The attacker then forces an ungraceful disconnect, for example by dropping the TCP session without sending DISCONNECT. The broker publishes the attacker's payload to the restricted topic without evaluating write permissions, delivering the message to all subscribers of that topic.

java

// Patch applied in PostOffice.java (v0.18.1)
            }
        }
        MqttPublishMessage willPublishMessage = publishBuilder.build();
        if (!authorizator.canWrite(Topic.asTopic(will.topic), "", WILL_PUBLISHER)) {
            LOG.error("client is not authorized to publish Last Will Testament on topic: {}", will.topic);
            return;
        }
        publish2Subscribers(WILL_PUBLISHER, messageExpiryInstant, willPublishMessage);
    }

Source: Moquette commit e23df01

Detection Methods for CVE-2026-85058

Indicators of Compromise

MQTT CONNECT packets from unauthenticated clients that set a Will Topic matching an ACL-restricted topic pattern.
Abrupt client TCP session terminations that immediately precede unexpected PUBLISH events on protected topics.
Broker logs showing Last Will delivery to topics that the connecting client identifier has no configured publish rights for.

Detection Strategies

Correlate the WILL_PUBLISHER message source in Moquette broker logs against the configured ACL policy to flag any Last Will publish targeting a restricted topic.
Ingest MQTT broker logs into a security data lake and build a rule that alerts when a client session lifespan is under a defined threshold and results in a Will delivery on a sensitive topic.
Baseline expected Last Will topics per client identifier and alert on deviations, since legitimate clients rarely designate ACL-protected topics as Will Topics.

Monitoring Recommendations

Enable verbose logging for the PostOffice component to capture Will Topic values and publisher identity for every connection.
Forward broker telemetry and network flow data to a centralized analytics platform so short-lived sessions and abnormal disconnects can be reviewed alongside downstream MQTT subscriber activity.
Monitor subscriber consumers on sensitive topics for messages whose provenance metadata identifies the Will publisher path.

How to Mitigate CVE-2026-85058

Immediate Actions Required

Upgrade Moquette to version 0.18.1 or later, which enforces authorizator.canWrite on Last Will publish operations.
Disable anonymous access on internet-reachable brokers and require authenticated clients wherever feasible.
Audit existing ACL policies to confirm that every sensitive topic explicitly denies writes from unknown or anonymous principals.

Patch Information

The fix is delivered in Moquette release v0.18.1. The change is tracked in GitHub Security Advisory GHSA-9jjc-fw8x-fmwx and applied through commits e23df01 and f5a323f. The patch adds a canWrite check inside PostOffice.publishWill and drops the message when the calling client lacks write permission on the Will Topic.

Workarounds

Require client authentication and remove anonymous connection support until the patched version is deployed.
Restrict broker network exposure with firewall rules that limit MQTT port access to trusted client networks.
Configure the authorizer to reject connections that declare a Will Topic on any sensitive topic pattern, using a wrapper layer if the deployed version does not natively validate Will Topics.

bash

# Verify installed Moquette version and upgrade
mvn dependency:tree | grep moquette
# Update dependency coordinate to the fixed release
# <dependency>
#   <groupId>io.moquette</groupId>
#   <artifactId>moquette-broker</artifactId>
#   <version>0.18.1</version>
# </dependency>