Skip to content
OpenAdvisories

Vendor

moquette-io

9 known vulnerabilities.

Products

moquette 9
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-95848

    Moquette fails open when configured authentication or authorization classes cannot load

    Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configu…

    moquette-io moquette
  • Critical 9.6
    CVE-2026-85724

    Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass

    Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an…

    moquette-io moquette io.moquette:moquette-broker Maven