CVE-2026-95848 moquette-io CVE debrief

Who should care

Defenders responsible for Moquette MQTT broker deployments should assess their exposure and verify that custom authenticator or authorizator classes are correctly configured and loaded.

Why it matters

CVE-2026-95848 is a critical vulnerability in Moquette MQTT broker that can lead to authentication and authorization bypass. Defenders should prioritize verifying their Moquette versions and ensuring correct configuration of custom classes.

• Potential authentication and authorization bypass
• Increased risk of unauthorized access to MQTT broker

Technical summary

The vulnerability occurs when a configured authenticator or authorizator class cannot be loaded in Moquette, causing it to default to insecure policies. This can happen due to a misspelled class name, missing dependency, constructor failure, or classpath issues. The issue is resolved in version 0.18.1. Defenders should prioritize verifying their Moquette versions and ensuring that custom authenticator or authorizator classes are correctly configured and loaded. Affected deployments may face authentication and authorization bypass risks.

Defensive priority

Defenders should prioritize verifying their Moquette versions and ensuring that custom authenticator or authorizator classes are correctly configured and loaded.

Recommended defensive actions

• Verify Moquette version and upgrade to 0.18.1 if necessary
• Review and validate custom authenticator or authorizator class configurations
• Ensure correct loading of custom classes
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, its impact, and the fixed version. However, additional information about potential exploits or attacks is limited. Defenders should verify Moquette versions, custom class configurations, and loading. Limited public evidence exists about exploit attempts or campaigns. Official vendor guidance advises upgrading to version 0.18.1 and validating custom authenticator or authorizator classes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.