CVE-2026-95846 moquette-io CVE debrief

Who should care

Defenders responsible for MQTT brokers using Moquette, security teams, administrators, and operators impacted by potential unauthorized message injection into restricted topics should assess exposure and prioritize verification and remediation efforts. This includes teams managing affected platforms, vulnerability management teams, and security teams responsible for monitoring and incident response.

Why it matters

CVE-2026-95846 is a high-severity vulnerability in Moquette that allows unauthorized message injection. Defenders should prioritize verification, exposure assessment, and remediation efforts.

• Potential for unauthorized message injection into restricted topics
• Possible disruption of MQTT broker functionality
• Need for verification of Moquette version and exposure
• Priority for upgrading to fixed version 0.18.1

Technical summary

Moquette, a lightweight Java MQTT broker, has a vulnerability (CVE-2026-95846) that allows unauthorized message injection into restricted topics. This occurs because the PostOffice.publishWill method does not apply canWrite authorization and reserved-topic checks for Last-Will messages, unlike normal PUBLISH messages. A client can configure a Will for a topic it is not permitted to write, causing the broker to publish an unauthorized message when the client disconnects unexpectedly. The issue is fixed in Moquette version 0.18.1.

Defensive priority

Defenders should prioritize verifying and upgrading to Moquette version 0.18.1 or later, and assess exposure for MQTT brokers using Moquette.

Recommended defensive actions

• Verify Moquette version and upgrade to 0.18.1 or later if necessary
• Assess exposure for MQTT brokers using Moquette
• Monitor for unauthorized messages in restricted topics
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Plan vendor-supported updates through normal change control

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed version. Vendor advisory and patch information are available. Defenders should verify Moquette version, assess exposure, and prioritize remediation efforts based on the provided information and evidence limits. Limited source detail is available; explicit evidence limits apply.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.