CVE-2026-95846

UNKNOWN 0.0

Moquette publishes Last-Will messages without enforcing write authorization

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to write and cause the broker to publish the unauthorized message when the client disconnects unexpectedly. This issue allows unauthorized message injection into restricted topics. This issue is fixed in version 0.18.1.

CWE	CWE-862
Vendor	moquette-io
Product	moquette
Published	Sep 23, 2026

Stay Ahead of the Next One

Get instant alerts for moquette-io moquette

Be the first to know when new unknown vulnerabilities affecting moquette-io moquette are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

moquette-io / moquette

< 0.18.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq github.com: https://github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec6c96973 github.com: https://github.com/moquette-io/moquette/releases/tag/v0.18.1