{"cve":"CVE-2026-95846","nvd":{"published":"2026-09-23T17:17:21.627","modified":"2026-09-25T13:34:02.580","status":"Analyzed","description":"Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to write and cause the broker to publish the unauthorized message when the client disconnects unexpectedly. This issue allows unauthorized message injection into restricted topics. This issue is fixed in version 0.18.1.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":8.7},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5},"cwes":["CWE-862"],"references":["https://github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec6c96973","https://github.com/moquette-io/moquette/releases/tag/v0.18.1","https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"],"products":["moquette:moquette"],"source":"nvd","synced_at":"2026-10-19T22:56:02.509636177+00:00"},"epss":{"cve":"CVE-2026-95846","score":0.00319,"percentile":0.24901,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-5f42-97gr-vfhq","url":"https://osv.dev/vulnerability/GHSA-5f42-97gr-vfhq","summary":"Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug","modified":"2026-10-19T19:30:12.063094642Z","packages":[{"ecosystem":"Maven","name":"io.moquette:moquette-broker","purl":"pkg:maven/io.moquette/moquette-broker","ranges":["<0.18.1"],"fixed":["0.18.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}