CVE-2026-85724: Moquette MQTT Broker Auth Bypass Vulnerability

CVE-2026-85724 Overview

CVE-2026-85724 is an authorization bypass vulnerability in Moquette, a lightweight Java MQTT broker. The flaw exists in AuthorizationsCollector.canDoOperation when pattern-based Access Control List (ACL) rules use the %c (client ID) or %u (username) placeholders. Moquette substitutes those identity values directly into ACL rules and then treats the result as an MQTT topic filter. A client that includes MQTT wildcards (+ or #) in its identity can broaden the substituted filter and gain cross-tenant read and write access. A # identity can also produce an invalid filter that triggers a NullPointerException in Topic.match, disrupting session processing. Versions prior to 0.18.1 are affected.

Critical Impact

Authenticated MQTT clients can escape tenant boundaries, read and publish to arbitrary topics, and crash broker session handling by supplying wildcard characters in the client ID or username.

Affected Products

• Moquette MQTT broker versions prior to 0.18.1
• Deployments using pattern-based ACL rules containing %c or %u placeholders
• Multi-tenant MQTT environments relying on Moquette for topic isolation

Discovery Timeline

• 2026-09-23 - CVE-2026-85724 published to the National Vulnerability Database (NVD)
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-85724

Vulnerability Analysis

Moquette supports pattern-based ACL rules that reference the connecting client's identity through %c and %u placeholders. At authorization time, AuthorizationsCollector.canDoOperation performs literal string substitution of the client ID and username into the configured ACL topic pattern. The substituted string is then parsed as an MQTT topic filter and compared with the topic the client is attempting to publish to or subscribe to.

MQTT topic filters treat + as a single-level wildcard and # as a multi-level wildcard. Because Moquette does not sanitize identity values before substitution, an attacker-supplied wildcard becomes part of the ACL filter itself. A rule intended to restrict a client to its own subtree, such as tenants/%c/#, expands into a broader filter when the client ID contains + or #, permitting cross-tenant access to publish and subscribe operations. This is a parsing and neutralization defect classified under [CWE-155] (improper neutralization of wildcards in a security-decision context).

Root Cause

The root cause is missing input neutralization. Identity strings supplied during MQTT CONNECT are trusted and passed unchanged into topic-filter construction. The broker conflates identity data with topic-filter syntax, so any MQTT metacharacter present in the identity alters the semantics of the ACL check.

Attack Vector

An attacker connects to the broker with credentials that include MQTT wildcards in the client ID or username fields. Once authenticated, the attacker issues SUBSCRIBE or PUBLISH requests against topics owned by other tenants. The broadened ACL filter matches those topics and the operation is permitted. Alternatively, a client ID consisting of # produces an invalid filter that raises a NullPointerException in Topic.match, disrupting broker session processing and enabling denial of service.

 package io.moquette.broker.security;
 
 import io.moquette.broker.subscriptions.Topic;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import java.text.ParseException;
 import java.util.*;

Source: Moquette security patch commit b4a98bb. The patch introduces logging support alongside identity validation logic that rejects wildcard characters before substitution.

Detection Methods for CVE-2026-85724

Indicators of Compromise

• MQTT CONNECT packets whose ClientID or Username fields contain the characters + or #
• Broker logs showing subscriptions or publishes to topics outside a client's expected tenant namespace
• NullPointerException stack traces originating from io.moquette.broker.subscriptions.Topic.match
• Unexpected session termination or broker instability correlated with newly connected clients

Detection Strategies

• Inspect MQTT broker access logs for identity strings containing wildcard characters and alert on any occurrence
• Correlate CONNECT events with subsequent SUBSCRIBE and PUBLISH activity to identify cross-tenant topic access
• Deploy MQTT-aware network sensors that decode CONNECT payloads and flag non-alphanumeric identifiers

Monitoring Recommendations

• Forward Moquette application logs to a centralized log platform and build alerts on NullPointerException events in Topic.match
• Baseline normal client ID and username formats per tenant, and alert on deviations
• Monitor for repeated session disconnects that could indicate exploitation of the denial-of-service path

How to Mitigate CVE-2026-85724

Immediate Actions Required

• Upgrade Moquette to version 0.18.1 or later on every broker instance
• Audit existing ACL configuration files for rules that reference %c or %u and inventory affected deployments
• Review authentication provisioning workflows to ensure client IDs and usernames cannot contain + or #
• Rotate credentials for any tenant whose identity fields historically permitted wildcard characters

Patch Information

The fix is available in Moquette release v0.18.1. The corrective code is included in commit b4a98bb. Additional context is provided in GitHub Security Advisory GHSA-5f42-97gr-vfhq.

Workarounds

• If patching is not immediately possible, remove %c and %u placeholders from ACL rules and replace pattern-based authorization with explicit per-identity rules
• Enforce identity validation at the authenticator layer to reject any client ID or username containing +, #, or /
• Restrict broker exposure so that only known, provisioned clients from trusted networks can reach the MQTT listener

# Example provisioning-side validation (reject wildcards in identities)
if [[ "$CLIENT_ID" =~ [+#/] ]] || [[ "$USERNAME" =~ [+#/] ]]; then
  echo "Invalid identity: MQTT wildcards not permitted" >&2
  exit 1
fi