Moquette fails open when configured authentication or authorization classes cannot load
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to AcceptAllAuthenticator or PermitAllAuthorizatorPolicy. A misspelled class name, missing dependency, constructor failure, or classpath problem can therefore start the broker with authentication or authorization disabled even though the operator configured those controls. This issue is fixed in version 0.18.1.
beschreibt (7)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-95847US | high7.5OT erhöht | — | ||
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue_ plus the client ID and its metadata-map name as queue_… | ||||
| CVE-2026-95846US | high7.5OT erhöht | — | ||
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-… | ||||
| CVE-2026-95845US | high7.5OT erhöht | — | ||
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messag… | ||||
| CVE-2026-95844US | high7.5OT erhöht | — | ||
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie inser… | ||||
| CVE-2026-95843US | high7.5OT erhöht | — | ||
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through SharedSubscriptionUtils.extractShareName before valida… | ||||
| CVE-2026-95842US | high7.5OT erhöht | — | ||
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. A… | ||||
| CVE-2026-85724US | —OT erhöht | — | ||
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95848.jsonADVISORY
- https://github.com/moquette-io/moquette/commit/14a2f4fd280c8f6a791600c306cbccecb7c67007FIX
- https://github.com/moquette-io/moquette/pull/967FIX
- https://github.com/moquette-io/moquette/releases/tag/v0.18.1WEB
- https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhqADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2026-95848ADVISORY
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan