CVE-2026-95848

Summary

The flaw allows the MQTT broker to start without configured authentication or authorization, potentially exposing the system to unauthorized access.

Exploitability

Exploitation is relatively easy if the class name is misspelled or if there are missing dependencies, as these conditions can disable critical security features.

Blast radius

If exploited, this could lead to unauthorized access to the MQTT broker, potentially allowing malicious actors to publish or subscribe to topics without proper authorization.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to moquette version 0.18.1 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.