CVE-2026-85424: MOOS core-moos through 10.4.0 Missing Authentication for MOOSDB Publish, Subscribe and DB_CLEAR
MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated clients to connect with full publish, subscribe, and database clear privileges. Attackers can bypass the compile-time protocol string check and connect with arbitrary client names to execute privileged operations including DBCLEAR which resets all variables and clears client mail queues.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated client that can reach the MOOSDB wire-protocol service can exploit it. No credentials or user interaction are required.
What actions can an attacker perform after connecting?
An attacker can publish and subscribe to MOOSDB data and invoke DB_CLEAR. DB_CLEAR resets all variables and clears client mail queues, creating a complete integrity and availability impact.
Does restricting client names or relying on the compile-time protocol string check prevent exploitation?
No. Attackers can bypass the compile-time protocol string check and connect using arbitrary client names.
How can I determine whether an installation is affected?
Installations of MOOS core-moos through version 10.4.0 are affected. A reachable MOOSDB service that accepts an unauthenticated wire-protocol connection has the exposed behavior described.