{"cve":"CVE-2026-95848","nvd":{"published":"2026-09-23T17:17:21.947","modified":"2026-09-28T15:23:06.303","status":"Analyzed","description":"Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to AcceptAllAuthenticator or PermitAllAuthorizatorPolicy. A misspelled class name, missing dependency, constructor failure, or classpath problem can therefore start the broker with authentication or authorization disabled even though the operator configured those controls. This issue is fixed in version 0.18.1.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":9.3},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1},"cwes":["CWE-636"],"references":["https://github.com/moquette-io/moquette/commit/14a2f4fd280c8f6a791600c306cbccecb7c67007","https://github.com/moquette-io/moquette/pull/967","https://github.com/moquette-io/moquette/releases/tag/v0.18.1","https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"],"products":["moquette:moquette"],"source":"nvd","synced_at":"2026-10-19T22:56:02.509636177+00:00"},"epss":{"cve":"CVE-2026-95848","score":0.00424,"percentile":0.36696,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-5f42-97gr-vfhq","url":"https://osv.dev/vulnerability/GHSA-5f42-97gr-vfhq","summary":"Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug","modified":"2026-10-19T19:30:12.063094642Z","packages":[{"ecosystem":"Maven","name":"io.moquette:moquette-broker","purl":"pkg:maven/io.moquette/moquette-broker","ranges":["<0.18.1"],"fixed":["0.18.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}