cve-2026-95848

CRITICAL CVSS 9.3 vulnrichment
Description

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to AcceptAllAuthenticator or PermitAllAuthorizatorPolicy. A misspelled class name, missing dependency, constructor failure, or classpath problem can therefore start the broker with authentication or authorization disabled even though the operator configured those controls. This issue is fixed in version 0.18.1.

Timeline
Published
2026-09-23 16:29 UTC
Last Modified
2026-09-23
CVSS Details
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
Affected Products
  • moquette-io moquette
Weaknesses (CWE)
CWE-636
SSVC (CISA Stakeholder-Specific Vulnerability Categorization) CISA Coordinator v2.0.3
Exploitation
poc
Automatable
yes
Technical Impact
total
Decision timestamp
2026-09-23T17:58:35.511233Z

What is SSVC? — CISA's vulnerability-prioritisation framework using a decision tree rather than a single score.

References
Linked Vulnerabilities

No linked vulnerabilities found.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95848",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T17:58:35.511233Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T17:58:55.245Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "moquette",
          "vendor": "moquette-io",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.18.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to AcceptAllAuthenticator or PermitAllAuthorizatorPolicy. A misspelled class name, missing dependency, constructor failure, or classpath problem can therefore start the broker with authentication or authorization disabled even though the operator configured those controls. This issue is fixed in version 0.18.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-636",
              "description": "CWE-636: Not Failing Securely ('Failing Open')",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T16:29:58.300Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"
        },
        {
          "name": "https://github.com/moquette-io/moquette/pull/967",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/pull/967"
        },
        {
          "name": "https://github.com/moquette-io/moquette/commit/14a2f4fd280c8f6a791600c306cbccecb7c67007",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/commit/14a2f4fd280c8f6a791600c306cbccecb7c67007"
        },
        {
          "name": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1"
        }
      ],
      "source": {
        "advisory": "GHSA-h285-r7h3-gfjg",
        "discovery": "UNKNOWN"
      },
      "title": "Moquette fails open when configured authentication or authorization classes cannot load"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-95848",
    "datePublished": "2026-09-23T16:29:58.300Z",
    "dateReserved": "2026-09-22T16:39:45.794Z",
    "dateUpdated": "2026-09-23T17:58:59.375Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
View JSON API Download JSON