https://vulnerability.circl.lu/sightings/feed 2026-09-24T09:29:44.721212+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/19f53aef-09fc-4a44-8ace-c6e1190e9d6e/export 2026-09-24T09:29:44.748158+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "19f53aef-09fc-4a44-8ace-c6e1190e9d6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85724", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mw7x6b2xhz2r", "content": "CVE-2026-85724 - io.moquette:moquette-broker\nThe Moquette MQTT broker lets any connecting client bypass topic permissions and read or write data belonging to other users, and a malformed subscription can stop\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#moquette #Java #CVE #infosec", "creation_timestamp": "2026-09-24T00:00:19.359073Z"} 2026-09-24T00:00:19.359073+00:00 https://vulnerability.circl.lu/sighting/eb0054e5-50db-4d36-b2c9-785e02b8fc55/export 2026-09-24T09:29:44.750137+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "eb0054e5-50db-4d36-b2c9-785e02b8fc55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-85724", "type": "published-proof-of-concept", "source": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq", "content": "", "creation_timestamp": "2026-09-23T18:35:02.241559Z"} 2026-09-23T18:35:02.241559+00:00 https://vulnerability.circl.lu/sighting/b06eb10a-6739-4657-b3b6-759e7e08b750/export 2026-09-24T09:29:44.753152+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "b06eb10a-6739-4657-b3b6-759e7e08b750", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85724", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mw7dj2q3mf2f", "content": "\ud83d\udea8 CVE-2026-85724 \u2014 CVSS 9.6 CRITICAL\n\nMoquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, A...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-85724\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-23T18:08:17.292364Z"} 2026-09-23T18:08:17.292364+00:00 https://vulnerability.circl.lu/sighting/e83780e8-4e12-4dfb-a3c7-f3852b185527/export 2026-09-24T09:29:44.753329+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "e83780e8-4e12-4dfb-a3c7-f3852b185527", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85724", "type": "seen", "source": "https://gist.github.com/alon710/08e10cd96ef3773d0fb4e2857a496796", "content": "# CVE-2026-85724: CVE-2026-85724: Pattern-ACL Wildcard Injection & Cross-Tenant Authorization Bypass in Moquette MQTT Broker\n\n> **CVSS Score:** 9.6\n> **Published:** 2026-09-23\n> **Full Report:** https://cvereports.com/reports/CVE-2026-85724\n\n## Summary\nCVE-2026-85724 is a critical vulnerability in the Moquette MQTT broker (versions prior to 0.18.1) where unvalidated substitution of client identifiers and usernames into pattern-based Access Control Lists (ACLs) permits remote authenticated attackers to bypass multi-tenant boundaries and trigger a Denial of Service.\n\n## TL;DR\nA critical flaw in Moquette versions < 0.18.1 allows remote clients to inject MQTT wildcards into their Client ID or username, bypassing pattern-based ACLs for cross-tenant topic access, or triggering a NullPointerException that silences the shared event loop and crashes the broker's session handling.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-863, CWE-155\n- **Attack Vector**: Network (Unauthenticated or Low-Privilege Remote)\n- **CVSS v3.1 Score**: 9.6 (Critical)\n- **EPSS Score**: N/A\n- **Impact**: Cross-Tenant Authorization Bypass & Denial of Service\n- **Exploit Status**: Proof of Concept / Code-Level Analysis\n- **KEV Status**: Not Listed in CISA KEV Catalog\n\n## Affected Systems\n\n- Moquette MQTT Broker versions prior to 0.18.1\n- **Moquette**: < 0.18.1 (Fixed in: `0.18.1`)\n\n## Mitigation\n\n- Upgrade the Moquette broker dependency to version 0.18.1 or higher.\n- Filter and reject connection requests containing wildcard characters (+ or #) at the reverse proxy or network gateway level.\n- Transition from dynamic pattern-based ACLs to static, explicit user-to-topic mapping rules.\n\n**Remediation Steps:**\n1. Identify all deployed instances of the Moquette broker within the application infrastructure.\n2. Update the project build files (e.g., pom.xml or build.gradle) to point to version 0.18.1.\n3. Deploy the updated application to staging environments and verify that normal client communication works as expected.\n4. Verify that clients attempting to connect with '+' or '#' inside their client ID are blocked from matching pattern rules, and check that warnings are generated in the application logs.\n5. Roll out the patched application version across production systems.\n\n## References\n\n- [GitHub Security Advisory GHSA-5f42-97gr-vfhq](https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq)\n- [Official Release v0.18.1](https://github.com/moquette-io/moquette/releases/tag/v0.18.1)\n- [CVE Registry Entry](https://www.cve.org/CVERecord?id=CVE-2026-85724)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-85724) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T17:31:57.896983Z"} 2026-09-23T17:31:57.896983+00:00