CVE-2026-95846: Moquette MQTT Broker Auth Bypass Vulnerability

CVE-2026-95846 Overview

CVE-2026-95846 is a missing authorization vulnerability [CWE-862] in Moquette, a lightweight Java MQTT broker. In versions prior to 0.18.1, the PostOffice.publishWill method publishes a client's Last-Will and Testament (LWT) message without enforcing the canWrite authorization check or the reserved-topic checks that apply to a normal PUBLISH. An attacker who connects with credentials that lack write permission on a restricted topic can still register a Will for that topic. When the client disconnects unexpectedly, the broker publishes the unauthorized message to subscribers.

Critical Impact
Authenticated clients can inject arbitrary messages into restricted MQTT topics they are not permitted to write to, bypassing broker-level access control on Last-Will publishing.

Affected Products

Moquette MQTT broker versions prior to 0.18.1
Java-based MQTT deployments using Moquette with topic authorization (ACL) enforcement
IoT and messaging platforms embedding the Moquette broker library

Discovery Timeline

2026-09-23 - CVE-2026-95846 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database
Fix released - Moquette v0.18.1 published with the authorization check

Technical Details for CVE-2026-95846

Vulnerability Analysis

Moquette implements MQTT topic-level access control through an IAuthorizator interface that gates PUBLISH operations via a canWrite check. Normal publish flows route through code paths that verify the requesting client can write to the target topic and that the topic is not a reserved system topic. The Last-Will publish flow in PostOffice.publishWill bypassed both of these checks and invoked publish2Subscribers directly.

Because MQTT allows a client to register a Will payload and target topic during the CONNECT handshake, an authenticated but low-privileged client can stage a message on any topic. The broker delivers that message to subscribers when the session terminates without a graceful DISCONNECT. The result is unauthorized message injection into ACL-restricted topics, which can be abused to send forged control commands, spoofed telemetry, or reserved-topic payloads to downstream consumers.

Root Cause

The root cause is a missing authorization check [CWE-862] in the Last-Will publish path. The reserved-topic filter and the authorizator.canWrite(topic, username, clientId) call that guard interactive PUBLISH messages were never invoked for Will messages built inside PostOffice.publishWill.

Attack Vector

An attacker with valid broker credentials connects and includes a Will message targeting a topic they cannot legitimately publish to. The attacker then triggers an ungraceful disconnect (TCP reset, keepalive timeout, or process kill). The broker builds the MqttPublishMessage from the stored Will and delivers it to all matching subscribers without evaluating write permissions.

java

// Patch: broker/src/main/java/io/moquette/broker/PostOffice.java
            }
        }
        MqttPublishMessage willPublishMessage = publishBuilder.build();
-
+        if (!authorizator.canWrite(Topic.asTopic(will.topic), "", WILL_PUBLISHER)) {
+            LOG.error("client is not authorized to publish Last Will Testament on topic: {}", will.topic);
+            return;
+        }
        publish2Subscribers(WILL_PUBLISHER, messageExpiryInstant, willPublishMessage);
    }

Source: Moquette commit f5a323f

Detection Methods for CVE-2026-95846

Indicators of Compromise

Broker log entries showing Will messages delivered to topics the publishing client lacks write ACLs for.
MQTT sessions that repeatedly connect with a Will payload and terminate without a clean DISCONNECT packet.
Subscribers on restricted or reserved topics receiving messages tagged with a source client identifier that has no matching write ACL rule.

Detection Strategies

Correlate CONNECT packets containing Will flags with the ACL rules assigned to the connecting username and clientId. Flag mismatches for review.
Enable broker debug logging around PostOffice.publishWill and alert on Will publishes that target reserved topics (topics beginning with $) or topics outside the client's ACL scope.
Inspect Moquette dependency inventories in software bills of materials (SBOMs) for versions earlier than 0.18.1.

Monitoring Recommendations

Forward broker access, ACL, and disconnect logs to a centralized analytics platform and build queries for anomalous Will publish events per client.
Track ratios of ungraceful disconnects to total sessions per client identifier to surface clients weaponizing Will delivery.
Alert on any published message that references a reserved MQTT topic prefix or a topic with no legitimate publisher mapped in the ACL policy.

How to Mitigate CVE-2026-95846

Immediate Actions Required

Upgrade Moquette to version 0.18.1 or later, which enforces canWrite on Last-Will publishing.
Audit existing ACL policies to confirm that no username or clientId has been granted broad write access as a workaround for prior Will handling.
Review broker logs for historical Will publishes into restricted topics and treat matches as potential unauthorized message injection.

Patch Information

The fix is included in Moquette v0.18.1. The patch adds an authorizator.canWrite(Topic.asTopic(will.topic), "", WILL_PUBLISHER) check inside PostOffice.publishWill and returns early when authorization fails, logging the denied topic. See the GitHub Security Advisory GHSA-5f42-97gr-vfhq for full advisory details.

Workarounds

If patching is not immediately feasible, restrict which clients may connect with a Will flag by enforcing pre-authentication policies at a network proxy or MQTT gateway.
Deny anonymous or low-trust clients from establishing sessions on brokers that host sensitive or reserved topics.
Monitor and terminate sessions whose declared Will topic falls outside the client's ACL scope before an ungraceful disconnect can occur.

bash

# Verify installed Moquette version and upgrade via Maven
mvn dependency:tree | grep moquette
# Update pom.xml to the fixed release
# <dependency>
#   <groupId>io.moquette</groupId>
#   <artifactId>moquette-broker</artifactId>
#   <version>0.18.1</version>
# </dependency>
mvn clean package