CVE-2026-85432

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-85432
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85432.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-85432
Published
2026-09-03T22:38:25.782Z
Modified
2026-09-06T03:30:53.297371284Z
Severity
  • 8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
MOOS core-moos through 10.4.0 MOOSDB Message Source Spoofing via Wire Identity
Details

MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers can forge message origins and cancel third-party subscriptions by exploiting the disconnect between authenticated connection identity and wire-supplied source attribution.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85432.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-290"
    ]
}
References

Affected packages

Git / github.com/themoos/core-moos

Affected ranges

Type
GIT
Repo
https://github.com/themoos/core-moos
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
19d06a9aefc910b0504c2c8589b1403f3b6e77a8
Fixed
26308f0e393f0e80bfa09b275891e776b8dbf522
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "10.4.0"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

10.*
10.0.1-devel
10.0.2-devel
10.0.3-devel-candidate
Other
IvPCompatibility
PreProfilingmerge
v10.*
v10.0.4-alpha

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85432.json"