{"vulnerability": "CVE-2026-8572", "sightings": [{"uuid": "1c6b8615-519e-4927-bcb1-7fe0123c43df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8572", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mltqzvr7j22t", "content": "CVE-2026-8572 - Google Chrome Android Cross-Origin Data Leakage\nCVE ID : CVE-2026-8572\n \n Published : May 14, 2026, 8:17 p.m. | 13\u00a0minutes ago\n \n Description : Insufficient policy enforcement in Network in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attac...", "creation_timestamp": "2026-05-14T21:26:27.824898Z"}, {"uuid": "82da2714-a139-4be8-8800-b7d90075aaea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-8572", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities_20260515", "content": "", "creation_timestamp": "2026-05-14T18:00:00.000000Z"}, {"uuid": "0cf720a5-e597-43ba-960e-ddcd68731f87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-8572", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities_20260518", "content": "", "creation_timestamp": "2026-05-17T18:00:00.000000Z"}, {"uuid": "a39817c1-f6de-45a8-8831-88d7bc03c6ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85721", "type": "seen", "source": "Telegram/5yYcJ8KxvxPc2wm8yAMZr4IlCi_IPgBAjiTQuvArbIBOcZs", "content": "", "creation_timestamp": "2026-09-22T07:00:07.728288Z"}, {"uuid": "f060b556-b96b-4853-b48d-2a0f7f3b0e1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-85725", "type": "published-proof-of-concept", "source": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-c759-cx9p-mrwq", "content": "", "creation_timestamp": "2026-09-22T22:35:20.107115Z"}, {"uuid": "0ab78e2c-96a9-45c5-983d-0b9b67542fc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85721", "type": "published-proof-of-concept", "source": "Telegram/5yYcJ8KxvxPc2wm8yAMZr4IlCi_IPgBAjiTQuvArbIBOcZs", "content": "", "creation_timestamp": "2026-09-23T00:00:14.470879Z"}, {"uuid": "14961872-b4b1-40d5-807f-c3e81d8e160f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85725", "type": "seen", "source": "https://gist.github.com/alon710/0d3b32340b0e22813aee7b5053c88ded", "content": "# CVE-2026-85725: CVE-2026-85725: Observable Timing Side-Channel Vulnerability in HKUDS LightRAG\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-85725\n\n## Summary\nHKUDS LightRAG prior to version 1.5.5 is vulnerable to multiple timing side-channels (CWE-208) in its API authentication layer. The password verification logic in `lightrag/api/passwords.py` compares plaintext administrative credentials using Python's short-circuiting equality operator (`==`). Additionally, `lightrag/api/auth.py` terminates authentication early on non-existent usernames, creating an observable latency difference compared to computationally expensive bcrypt comparisons on valid accounts. Together, these allow remote unauthenticated attackers with low-latency network access to enumerate valid usernames and extract plaintext passwords character by character.\n\n## TL;DR\nUnauthenticated remote timing side-channels in HKUDS LightRAG authentication logic permit username enumeration and plaintext password recovery.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-208: Observable Timing Discrepancy\n- **Attack Vector**: Network (Low-latency / High-precision)\n- **CVSS v3.1**: 5.9 (Medium)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n- **Impact**: Administrative Credential Recovery & Username Enumeration\n\n## Affected Systems\n\n- HKUDS LightRAG\n- **LightRAG**: < 1.5.5 (Fixed in: `1.5.5`)\n\n## Mitigation\n\n- Upgrade HKUDS LightRAG deployments to version 1.5.5 or higher.\n- Store administrative credentials as bcrypt-hashed strings instead of plaintext values.\n- Configure web application firewalls (WAF) or rate-limiters to restrict rapid, automated attempts on the /login endpoint.\n\n**Remediation Steps:**\n1. Update dependencies in requirements.txt or pip configurations to pin LightRAG to version 1.5.5 or above.\n2. Locate the administrative credential configurations inside the environment or config files.\n3. Generate a bcrypt hash of the administrative password.\n4. Format the credentials using the `{bcrypt}` prefix, for example: `AUTH_ACCOUNTS=admin:{bcrypt}$2b$12$...`.\n5. Restart the LightRAG service to apply the secure configurations.\n\n## References\n\n- [GitHub Security Advisory GHSA-c759-cx9p-mrwq](https://github.com/HKUDS/LightRAG/security/advisories/GHSA-c759-cx9p-mrwq)\n- [HKUDS LightRAG Official Pull Request 3423](https://github.com/HKUDS/LightRAG/pull/3423)\n- [HKUDS LightRAG Release Version v1.5.5](https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5)\n- [NVD Record for CVE-2026-85725](https://nvd.nist.gov/vuln/detail/CVE-2026-85725)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-85725) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T10:32:03.678163Z"}, {"uuid": "e83780e8-4e12-4dfb-a3c7-f3852b185527", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85724", "type": "seen", "source": "https://gist.github.com/alon710/08e10cd96ef3773d0fb4e2857a496796", "content": "# CVE-2026-85724: CVE-2026-85724: Pattern-ACL Wildcard Injection & Cross-Tenant Authorization Bypass in Moquette MQTT Broker\n\n> **CVSS Score:** 9.6\n> **Published:** 2026-09-23\n> **Full Report:** https://cvereports.com/reports/CVE-2026-85724\n\n## Summary\nCVE-2026-85724 is a critical vulnerability in the Moquette MQTT broker (versions prior to 0.18.1) where unvalidated substitution of client identifiers and usernames into pattern-based Access Control Lists (ACLs) permits remote authenticated attackers to bypass multi-tenant boundaries and trigger a Denial of Service.\n\n## TL;DR\nA critical flaw in Moquette versions < 0.18.1 allows remote clients to inject MQTT wildcards into their Client ID or username, bypassing pattern-based ACLs for cross-tenant topic access, or triggering a NullPointerException that silences the shared event loop and crashes the broker's session handling.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-863, CWE-155\n- **Attack Vector**: Network (Unauthenticated or Low-Privilege Remote)\n- **CVSS v3.1 Score**: 9.6 (Critical)\n- **EPSS Score**: N/A\n- **Impact**: Cross-Tenant Authorization Bypass & Denial of Service\n- **Exploit Status**: Proof of Concept / Code-Level Analysis\n- **KEV Status**: Not Listed in CISA KEV Catalog\n\n## Affected Systems\n\n- Moquette MQTT Broker versions prior to 0.18.1\n- **Moquette**: < 0.18.1 (Fixed in: `0.18.1`)\n\n## Mitigation\n\n- Upgrade the Moquette broker dependency to version 0.18.1 or higher.\n- Filter and reject connection requests containing wildcard characters (+ or #) at the reverse proxy or network gateway level.\n- Transition from dynamic pattern-based ACLs to static, explicit user-to-topic mapping rules.\n\n**Remediation Steps:**\n1. Identify all deployed instances of the Moquette broker within the application infrastructure.\n2. Update the project build files (e.g., pom.xml or build.gradle) to point to version 0.18.1.\n3. Deploy the updated application to staging environments and verify that normal client communication works as expected.\n4. Verify that clients attempting to connect with '+' or '#' inside their client ID are blocked from matching pattern rules, and check that warnings are generated in the application logs.\n5. Roll out the patched application version across production systems.\n\n## References\n\n- [GitHub Security Advisory GHSA-5f42-97gr-vfhq](https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq)\n- [Official Release v0.18.1](https://github.com/moquette-io/moquette/releases/tag/v0.18.1)\n- [CVE Registry Entry](https://www.cve.org/CVERecord?id=CVE-2026-85724)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-85724) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T17:31:57.896983Z"}, {"uuid": "b06eb10a-6739-4657-b3b6-759e7e08b750", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85724", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mw7dj2q3mf2f", "content": "\ud83d\udea8 CVE-2026-85724 \u2014 CVSS 9.6 CRITICAL\n\nMoquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, A...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-85724\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-23T18:08:17.292364Z"}, {"uuid": "eb0054e5-50db-4d36-b2c9-785e02b8fc55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-85724", "type": "published-proof-of-concept", "source": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq", "content": "", "creation_timestamp": "2026-09-23T18:35:02.241559Z"}, {"uuid": "19f53aef-09fc-4a44-8ace-c6e1190e9d6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85724", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mw7x6b2xhz2r", "content": "CVE-2026-85724 - io.moquette:moquette-broker\nThe Moquette MQTT broker lets any connecting client bypass topic permissions and read or write data belonging to other users, and a malformed subscription can stop\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#moquette #Java #CVE #infosec", "creation_timestamp": "2026-09-24T00:00:19.359073Z"}, {"uuid": "46315562-577b-40de-a929-623846e839d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85724", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mwfhlcxklx2h", "content": "\ud83d\udccc CVE-2026-85724 - Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation subst... https://www.cyberhub.blog/cves/CVE-2026-85724", "creation_timestamp": "2026-09-26T04:37:06.906973Z"}]}