CVE-2026-95846: Moquette publishes Last-Will messages without enforcing write authorization
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to write and cause the broker to publish the unauthorized message when the client disconnects unexpectedly. This issue allows unauthorized message injection into restricted topics. This issue is fixed in version 0.18.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Moquetteto a version that resolves this vulnerability.Fixed in 0.18.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Moquette deployments running versions prior to 0.18.1 are affected if clients can configure Last-Will messages and the broker relies on write authorization or reserved-topic restrictions to protect MQTT topics.
What does an attacker need to exploit the issue?
An attacker needs to act as an MQTT client that can configure a Last-Will message. They can set its topic to one they are not authorized to write to, then cause the broker to publish it through an unexpected disconnect.
Are normal MQTT PUBLISH operations affected?
The issue is specific to Last-Will publication through PostOffice.publishWill. Normal PUBLISH operations use the canWrite authorization and reserved-topic checks that the vulnerable Last-Will path did not apply.
What should operators do if they cannot immediately upgrade?
The provided information identifies version 0.18.1 as the fix but does not specify a workaround. Until upgrading, treat Last-Will messages from untrusted clients as capable of injecting messages into topics otherwise restricted by write authorization.