CVE-2026-85724

Katalog CVE

CVSS 9.6 · Critical EPSS 0,27%

Kerentanan Improper Neutralization of Wildcards or Matching Symbols pada moquette. Skor CVSS 3.1 9.6 (Critical) menurut github.com.

Deskripsi (NVD)

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses + or # in either identity can broaden the substituted filter and gain cross-tenant read and write access. A # identity can also produce an invalid filter that triggers a NullPointerException in Topic.match and disrupts session processing. This issue is fixed in version 0.18.1.

Rincian

Terbit di NVD

23 September 2026

Terakhir diubah

25 September 2026

Status NVD

Analyzed

CVSS 3.1

9.6 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-155: Improper Neutralization of Wildcards or Matching Symbols
CWE-863: Incorrect Authorization

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 17,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq exploit · mitigasi · advisory vendor
• https://github.com/moquette-io/moquette/commit/b4a98bb3f3425ece476ed073aa080c627c1239af patch
• https://github.com/moquette-io/moquette/releases/tag/v0.18.1 release notes