Description
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to AcceptAllAuthenticator or PermitAllAuthorizatorPolicy. A misspelled class name, missing dependency, constructor failure, or classpath problem can therefore start the broker with authentication or authorization disabled even though the operator configured those controls. This issue is fixed in version 0.18.1.
Published: 2026-09-23
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Authentication/Authorization Bypass
Action: Immediate Patch
AI Analysis

Impact

Moquette, a lightweight Java MQTT broker, contains a flaw where a failure to load a configured authenticator or authorizator class is silently ignored, causing the broker to fallback to AcceptAllAuthenticator or PermitAllAuthorizatorPolicy. This results in the broker starting with authentication or authorization disabled even though controls were requested, granting any user that can connect full, unauthenticated access. The weakness is categorized as CWE‑636.

Affected Systems

The vulnerability affects the moquette-io Moquette broker. Versions prior to 0.18.1 are impacted. The issue was resolved in the 0.18.1 release and later versions.

Risk and Exploitability

The CVSS score of 9.3 indicates critical severity. EPSS is not reported and the vulnerability is not listed in CISA KEV. Attackers that can influence the broker’s classpath or configuration—such as by supplying a misspelled class name, omitting a dependency, or introducing a constructor failure—can trigger the fallback to a permissive policy. The likely attack vector is local configuration or tampering with the deployment environment, which allows an attacker to gain unauthenticated control once the broker is running.

Generated by OpenCVE AI on September 23, 2026 at 17:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to Moquette v0.18.1 or a later release that contains the fix.
  • Verify that all custom authenticator and authorizator classes are correctly named and placed on the broker’s classpath before startup to prevent accidental fallback.
  • Restrict network exposure to the MQTT broker until the configuration is confirmed to enforce authentication and authorization, and monitor logs for any unauthorized connection attempts.

Generated by OpenCVE AI on September 23, 2026 at 17:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 28 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Moquette
Moquette moquette
CPEs cpe:2.3:a:moquette:moquette:*:*:*:*:*:*:*:*
Vendors & Products Moquette
Moquette moquette
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Wed, 23 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
First Time appeared Moquette-io
Moquette-io moquette
Vendors & Products Moquette-io
Moquette-io moquette

Wed, 23 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
Description Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to AcceptAllAuthenticator or PermitAllAuthorizatorPolicy. A misspelled class name, missing dependency, constructor failure, or classpath problem can therefore start the broker with authentication or authorization disabled even though the operator configured those controls. This issue is fixed in version 0.18.1.
Title Moquette fails open when configured authentication or authorization classes cannot load
Weaknesses CWE-636
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Moquette Moquette
Moquette-io Moquette
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-23T17:58:59.375Z

Reserved: 2026-09-22T16:39:45.794Z

Link: CVE-2026-95848

cve-icon Vulnrichment

Updated: 2026-09-23T17:58:55.245Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-23T17:17:21.947

Modified: 2026-09-28T15:23:06.303

Link: CVE-2026-95848

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T18:15:07Z

Weaknesses
  • CWE-636

    Not Failing Securely ('Failing Open')