CVE-2026-85058

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-85058

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85058.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-85058

Aliases

GHSA-9jjc-fw8x-fmwx

Published

2026-09-18T17:40:39Z

Modified

2026-10-28T11:18:51Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

Moquette: Missing Authorization in io.moquette:moquette-broker

Details

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers without invoking the authorizator.canWrite check used by normal PUBLISH paths. When anonymous access is enabled and topic ACLs restrict writes, a remote client can set an ACL-protected topic as the Last Will Topic during CONNECT and perform an abnormal client disconnect, causing the broker to inject attacker-controlled messages into a topic for which the client lacks write permission. This issue is fixed in version 0.18.1.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85058.json"
}

References

Affected packages

Git / github.com/moquette-io/moquette

Affected ranges

Type

GIT

Repo

https://github.com/moquette-io/moquette

Events

Introduced

Fixed

e8ce83336acce69d8e9c11c98805217aa156a16b

Fixed

e23df019f6a11e22c7d2047d4f86d07095466c97

Fixed

f5a323fe782d1505c0097498cb22eb6ec6c96973

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "0.18.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "e23df019f6a11e22c7d2047d4f86d07095466c97"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "f5a323fe782d1505c0097498cb22eb6ec6c96973"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v0.18.1",
            "range": [
                {
                    "fixed": "e8ce83336acce69d8e9c11c98805217aa156a16b"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*

0.18.0

0.7

IOSB-v0.*

IOSB-v0.18.x-start

Other

before_sofia2

last_gradle

last_osgi

last_with_maven

last_with_ringbuffer

second_try_with_osgi_giveup

v0.*

v0.10

v0.11

v0.12

v0.12.1

v0.18.0

v0.8

v0.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85058.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "93344037886889013058802880122250972786",
                "215424287808860444922688016470130533230",
                "327029001158716180009488700243281639820"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-85058-18ab0d4e",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec6c96973",
        "target": {
            "file": "broker/src/main/java/io/moquette/broker/PostOffice.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "80257911369444266460095870659529128766",
            "length": 535
        },
        "id": "CVE-2026-85058-51aa42a0",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec6c96973",
        "target": {
            "file": "broker/src/main/java/io/moquette/broker/PostOffice.java",
            "function": "publishWill"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "93344037886889013058802880122250972786",
                "215424287808860444922688016470130533230",
                "327029001158716180009488700243281639820"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-85058-dafa77ea",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/e23df019f6a11e22c7d2047d4f86d07095466c97",
        "target": {
            "file": "broker/src/main/java/io/moquette/broker/PostOffice.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "264460424198365981025294149882277014898",
                "11410191927348774178838709852851310256",
                "273802157253247414129958982189405529275",
                "315296026132642631038163665576809441438"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-85058-dd85d397",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/e8ce83336acce69d8e9c11c98805217aa156a16b",
        "target": {
            "file": "broker/src/main/java/io/moquette/broker/Server.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "80257911369444266460095870659529128766",
            "length": 535
        },
        "id": "CVE-2026-85058-f03af28d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/e23df019f6a11e22c7d2047d4f86d07095466c97",
        "target": {
            "file": "broker/src/main/java/io/moquette/broker/PostOffice.java",
            "function": "publishWill"
        }
    }
]

vanir_signatures_modified

"2026-10-28T11:18:51Z"