CVE-2026-85428: MOOS core-moos through 10.4.0 MOOSDB HTTP Server Unauthenticated Variable Write
MOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in the optional MOOSDB HTTP server that allows unauthenticated clients to write variables. Attackers can send HTTP requests with variable names and values to the MOOSDB HTTP server port to modify MOOS variables including actuator and override commands without authentication.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated modification?
Deployments running MOOS core-moos through 10.4.0 are exposed if the optional MOOSDB HTTP server is enabled and reachable by an attacker. The vulnerable interface accepts HTTP requests on the MOOSDB HTTP server port.
What does an attacker need to exploit this issue?
An attacker needs network access to the MOOSDB HTTP server port. No authentication, privileges, or user interaction are required.
What could an attacker change through the vulnerable interface?
An attacker can submit variable names and values to modify MOOS variables. This can include actuator and override commands.
Is the default installation necessarily affected?
The issue is in the optional MOOSDB HTTP server, so exposure depends on whether that server is enabled. The provided information does not state whether it is enabled by default.
What mitigation is available if patching cannot happen immediately?
Restrict network access to the MOOSDB HTTP server port so untrusted clients cannot send HTTP requests to it. Disabling the optional HTTP server also removes the affected interface.