THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-9jjc-fw8x-fmwx (high) — io.moquette:moquette-broker has a Missing Authorization issue

[GHSA] GHSA-9jjc-fw8x-fmwx (high) — io.moquette:moquette-broker has a Missing Authorization issue

medgithub_advisoriesPublished 2026-09-18

GHSA-9jjc-fw8x-fmwx Severity: high CVE: CVE-2026-85058

io.moquette:moquette-broker has a Missing Authorization issue

## Summary

Moquette MQTT Broker fails to enforce ACL write permission checks when publishing Will (Last Will and Testament) messages on behalf of disconnected clients. All normal PUBLISH paths (`receivedPublishQos0`, `receivedPublishQos1`, `receivedPublishQos2`) correctly invoke

Indicators of compromise

CVE-2026-85058cve

Original source: https://github.com/advisories/GHSA-9jjc-fw8x-fmwx