CVE-2026-85724 Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses...

CVE-2026-85724

The Moquette Java MQTT broker is vulnerable to a cross-tenant authorization bypass in versions prior to 0.18.1 . When pattern-based ACL rules are used, the AuthorizationsCollector.canDoOperation component directly substitutes client ID and username values into rules containing %c or %u. If a clie...