https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 08:48:56 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-85058 <p>Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers without invoking the authorizator.canWrite check used by normal PUBLISH paths. When anonymous access is enabled and topic ACLs restrict writes, a remote client can set an ACL-protected topic as the Last Will Topic during CONNECT and perform an abnormal client disconnect, causing the broker to inject attacker-controlled messages into a topic for which the client lacks write permission. This issue is fixed in version 0.18.1.</p> <p>Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers without invoking the authorizator.canWrite check used by normal PUBLISH paths. When anonymous access is enabled and topic ACLs restrict writes, a remote client can set an ACL-protected topic as the Last Will Topic during CONNECT and perform an abnormal client disconnect, causing the broker to inject attacker-controlled messages into a topic for which the client lacks write permission. This issue is fixed in version 0.18.1.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-85058 https://vulnerability.circl.lu/vuln/ghsa-9jjc-fw8x-fmwx <p><strong>Affected:</strong> Maven: io.moquette:moquette-broker</p> <p>## Summary</p> <p>Moquette MQTT Broker fails to enforce ACL write permission checks when publishing Will (Last Will and Testament) messages on behalf of disconnected clients. All normal PUBLISH paths (`receivedPublishQos0`, `receivedPublishQos1`, `receivedPublishQos2`) correctly invoke `authorizator.canWrite()` before publishing, but the Will message publishing path (`fireWill()` → `publishWill()` → `publish2Subscribers()`) completely bypasses this authorization check.</p> <p>This allows an unauthenticated attacker (when `allow_anonymous=true`, which is the default) to inject arbitrary messages into any ACL-protected topic by setting a restricted topic as the Will Topic in the CONNECT packet and then disconnecting abruptly via TCP RST.</p> <p>Other major MQTT Broker implementations (Mosquitto, EMQX, HiveMQ) correctly enforce ACL checks on Will messages, confirming this is a bug, not a design choice.</p> <p>## Details</p> <p>In the MQTT protocol, a client can declare a &#34;Will&#34; topic and message in the CONNECT packet. When the client disconnects abnormally (without sending a DISCONNECT packet), the Broker publishes the Will message on behalf of the client. Although the Will message content (topic and payload) is entirely controlled by the connecting client — making it functionally equivalent to a PUBLISH — Moquette skips the ACL check for this path.</p> <p>### Root Cause</p> <p>**File**: `broker/src/main/java/io/moquette/broker/PostOffice.java` (v0.18.0)</p> <p>Will publishing path (lines 286-328) — **no canWrite() check**:…</p> <p><strong>Affected:</strong> Maven: io.moquette:moquette-broker</p> <p>## Summary</p> <p>Moquette MQTT Broker fails to enforce ACL write permission checks when publishing Will (Last Will and Testament) messages on behalf of disconnected clients. All normal PUBLISH paths (`receivedPublishQos0`, `receivedPublishQos1`, `receivedPublishQos2`) correctly invoke `authorizator.canWrite()` before publishing, but the Will message publishing path (`fireWill()` → `publishWill()` → `publish2Subscribers()`) completely bypasses this authorization check.</p> <p>This allows an unauthenticated attacker (when `allow_anonymous=true`, which is the default) to inject arbitrary messages into any ACL-protected topic by setting a restricted topic as the Will Topic in the CONNECT packet and then disconnecting abruptly via TCP RST.</p> <p>Other major MQTT Broker implementations (Mosquitto, EMQX, HiveMQ) correctly enforce ACL checks on Will messages, confirming this is a bug, not a design choice.</p> <p>## Details</p> <p>In the MQTT protocol, a client can declare a &#34;Will&#34; topic and message in the CONNECT packet. When the client disconnects abnormally (without sending a DISCONNECT packet), the Broker publishes the Will message on behalf of the client. Although the Will message content (topic and payload) is entirely controlled by the connecting client — making it functionally equivalent to a PUBLISH — Moquette skips the ACL check for this path.</p> <p>### Root Cause</p> <p>**File**: `broker/src/main/java/io/moquette/broker/PostOffice.java` (v0.18.0)</p> <p>Will publishing path (lines 286-328) — **no canWrite() check**:…</p> https://vulnerability.circl.lu/vuln/ghsa-9jjc-fw8x-fmwx