CVE-2026-85724 moquette-io CVE debrief

Who should care

MQTT service administrators, users of Moquette, and security teams responsible for monitoring and protecting MQTT infrastructure should assess their exposure to this vulnerability and apply patches or mitigations as necessary.

Why it matters

CVE-2026-85724 is a critical vulnerability in Moquette that allows unauthorized MQTT topic access and potential session disruption. Defenders should assess exposure, prioritize patching, and review client identities and ACL rules.

• Potential unauthorized access to MQTT topics
• Possible disruption of session processing
• Need for verification of client identities and ACL rules
• Priority for patching Moquette instances

Technical summary

Moquette, a lightweight Java MQTT broker, has a critical vulnerability (CVE-2026-85724) in its handling of pattern-based ACL rules. When these rules are used, the AuthorizationsCollector.canDoOperation method directly substitutes client ID and username values into the rules. This allows clients with + or # in their identity to potentially access unauthorized MQTT topics. A client with a # identity can also cause a NullPointerException, disrupting session processing. The issue is addressed in Moquette version 0.18.1.

Defensive priority

High priority for MQTT service administrators and users to assess exposure and apply patches

Recommended defensive actions

• Assess exposure of Moquette instances to untrusted clients
• Verify if using a version earlier than 0.18.1 and apply patches
• Review and restrict client identities and ACL rules
• Monitor for unusual MQTT topic access patterns
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE and NVD records provide details on the vulnerability, its impact, and the fixed version. Vendor advisories and patch notes are available. The issue allows clients to access unauthorized MQTT topics and potentially disrupt session processing. The vulnerability is fixed in Moquette version 0.18.1. Defenders should verify client identities and ACL rules, and review compensating controls for exposed systems. The CVE record was published on 2026-09-23T17:17:17.623Z and has not been modified since then. The NVD record provides

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.