Moquette MQTT Broker: Pattern-ACL Wildcard Injection Enables Cross-Tenant Bypass, Plus Unauthenticated DoS and Will-Message Flaws (GHSA-5f42-97gr-vfhq)

A newly published security advisory for io.moquette:moquette-broker, the open-source Java MQTT broker, discloses a cluster of authorization and availability flaws affecting deployments that use pattern-based ACL rules or accept anonymous/untrusted client connections. The advisory, assigned CVE-2026-85724 with a CVSS score of 9.6, includes public proof-of-concept code and was audited at commit da7f719a6bab9829d520b5838e13ea7b1f9be3ef in the broker/ module.

What was reported

According to the advisory, Moquette is reachable by untrusted MQTT clients by default (anonymous connections), meaning every byte received — including pre-authentication data — must be treated as untrusted. The researcher reports this is a memory-safe JVM application, so the practical ceiling is authorization/ACL bypass and denial of service rather than remote code execution; no RCE is claimed.

• Critical — Cross-tenant ACL bypass: In AuthorizationsCollector.canDoOperation, a client's raw clientId/username is substituted into pattern ACL rules (e.g., %c/%u tokens) without validating for MQTT wildcard characters (+/#) at CONNECT. A client connecting with a crafted clientId such as + can turn a scoped pattern like sensor/%c/# into an effective wildcard filter, gaining cross-tenant read and write access — contingent on pattern ACL rules being configured, which the advisory notes is common in multi-tenant setups.
• High — Broker-wide DoS: SessionEventLoop only catches InterruptedException and is never restarted, so several trivially reachable inputs (malformed $share/grp subscriptions, deeply nested topics causing stack overflow, an ACL null-pointer case) can wedge every client sharing that event loop. Unbounded subscription/retained-message/in-flight/interceptor state is also flagged as an OOM/disk-exhaustion risk.
• High — Will-message authorization bypass: Last-Will publishes are dispatched via PostOffice.publishWill without the same canWrite/reserved-topic checks applied to normal PUBLISH messages.
• Medium — Cross-session durable corruption: Colliding H2 persistent-queue naming (e.g., a clientId of sensor_meta colliding with another client's sensor metadata map) can corrupt queue head/tail pointers across sessions.
• Medium — Fail-open on auth-class load failure: If a configured authenticator/authorizator class fails to load, the broker reportedly falls back to permit-all/accept-all behavior.

Why it matters for defenders

Moquette is used as an embeddable MQTT broker in IoT, telemetry, and sensor-network deployments — exactly the environments where multi-tenant topic isolation (via pattern ACLs) is relied upon to keep one customer's or device fleet's data separate from another's. If pattern ACLs are in use, the injection flaw allows a low-privilege or even anonymous client to read and write topics belonging to other tenants without needing valid credentials for those topics. Independently, the DoS paths require no authentication at all, so any network-reachable client — not just misconfigured multi-tenant setups — can potentially crash or hang the broker for all connected clients. Organizations running Moquette as a shared or internet/OT-facing broker should treat this as high priority.

What defenders should watch for now

• Inventory whether you run Moquette (directly or embedded via the io.moquette:moquette-broker Maven artifact) and whether pattern-based ACL rules (using %c/%u substitution) are configured.
• Monitor broker logs for CONNECT attempts using clientIds or usernames containing MQTT wildcard characters (+, #) or unexpected / characters — these are the injection primitive described in the advisory.
• Watch for malformed $share/ shared-subscription filters, abnormally deep/nested topic hierarchies, and unexpected broker restarts or hangs, which could indicate exploitation of the DoS paths.
• Audit Will-message payloads and topics for content that would otherwise be blocked by normal PUBLISH ACL enforcement.
• Until a patched release is confirmed, consider restricting network access to the broker, disabling anonymous connections where feasible, and reviewing resource limits (connection counts, queue sizes, interceptor queues) as a stopgap against the DoS cluster.
• Apply the remediation guidance in the advisory once available: reject wildcard characters in clientId/username at CONNECT, harden the session event loop with proper exception handling and restart supervision, apply authorization checks to Will publishes, and fail closed on authenticator load failures.

Developing intel

This is a same-day advisory and the analysis above reflects only what has been publicly disclosed; patch availability and downstream advisory details may evolve. Defenders using Moquette should track the original GitHub Security Advisory for updates: GHSA-5f42-97gr-vfhq.