CVE-2026-85724

Summary

The flaw allows a client to substitute their identity into MQTT topic filters, potentially gaining unauthorized access to other tenants' data. This is due to direct substitution of client ID and username values into pattern-based ACL rules.

Exploitability

Exploitation is moderately hard as it requires a client to use + or # in their identity, but preconditions are minimal.

Blast radius

If exploited, the attacker could gain cross-tenant read and write access, leading to significant data breaches.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to moquette 0.18.1 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.