CVE-2026-95848: Moquette fails open when configured authentication or authorization classes cannot load
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to AcceptAllAuthenticator or PermitAllAuthorizatorPolicy. A misspelled class name, missing dependency, constructor failure, or classpath problem can therefore start the broker with authentication or authorization disabled even though the operator configured those controls. This issue is fixed in version 0.18.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Moquetteto a version that resolves this vulnerability.Fixed in 0.18.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Moquette deployments running versions before 0.18.1 are exposed if they configure a custom authenticator or authorizator class and that class fails to load. Deployments without custom authentication or authorization classes are not identified as affected by the provided information.
What conditions cause the broker to fail open?
The issue occurs when the configured authenticator or authorizator cannot be loaded, including from a misspelled class name, a missing dependency, a constructor failure, or a classpath problem. The broker then falls back to accepting all authentication or permitting all authorization.
How can an operator determine whether a running broker may be affected?
Review the configured custom authenticator and authorizator class names and verify that their classes and dependencies load successfully during broker startup. A broker that starts despite a failure to load one of these configured controls may be operating with AcceptAllAuthenticator or PermitAllAuthorizatorPolicy.
What remediation is available?
Upgrade Moquette to version 0.18.1, which fixes the fallback behavior. Until then, validate that configured authenticator and authorizator classes, their constructors, and all required dependencies are available on the broker classpath.