CVE-2017-9868

In Mosquitto through 1.4.12, mosquitto.db (aka the persistence file) is world readable, which...

5.5 MediumFix available

In Mosquitto through 1.4.12, mosquitto.db (aka the persistence file) is world readable, which allows local users to obtain sensitive MQTT topic information.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.36%Unchanged since Apr 14, 2021

What each source reports

NVD Score used 5.5

In Mosquitto through 1.4.12, mosquitto.db (aka the persistence file) is world readable, which allows local users to obtain sensitive MQTT topic information.

Record: CVE-2017-9868
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 2.1 LowAV:L/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

CVE List No score

In Mosquitto through 1.4.12, mosquitto.db (aka the persistence file) is world readable, which allows local users to obtain sensitive MQTT topic information.

Record: CVE-2017-9868
Updated: 2026-11-02

EUVDEUVD-2017-18778 No score

In Mosquitto through 1.4.12, mosquitto.db (aka the persistence file) is world readable, which allows local users to obtain sensitive MQTT topic information.

Record: EUVD-2017-18778
Updated: 2026-11-03

GitHub AdvisoriesGHSA-m438-p9g2-x57w 5.5

In Mosquitto through 1.4.12, mosquitto.db (aka the persistence file) is world readable, which...

In Mosquitto through 1.4.12, mosquitto.db (aka the persistence file) is world readable, which allows local users to obtain sensitive MQTT topic information.

Record: GHSA-m438-p9g2-x57w
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSVALPINE-CVE-2017-9868 5.5

In Mosquitto through 1.4.12, mosquitto.db (aka the persistence file) is world readable, which allows local users to obtain sensitive MQTT topic information.

Record: ALPINE-CVE-2017-9868
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVBELL-CVE-2017-9868 5.5

CVE-2017-9868 does not affect BellSoft software

Record: BELL-CVE-2017-9868
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

Show 4 moreShow less

OSV 5.5

In Mosquitto through 1.4.12, mosquitto.db (aka the persistence file) is world readable, which allows local users to obtain sensitive MQTT topic information.

Record: CVE-2017-9868
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2017-9868 5.5

In Mosquitto through 1.4.12, mosquitto.db (aka the persistence file) is world readable, which allows local users to obtain sensitive MQTT topic information.

Record: DEBIAN-CVE-2017-9868
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2017-9868 5.5

In Mosquitto through 1.4.12, mosquitto.db (aka the persistence file) is world readable, which allows local users to obtain sensitive MQTT topic information.

Record: UBUNTU-CVE-2017-9868
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVopenSUSE-SU-2024:11057-1 No score

libmosquitto1-2.0.11-1.2 on GA media

These are all security issues fixed in the libmosquitto1-2.0.11-1.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:11057-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`mosquitto` Alpine:v3.10	before 1.4.13-r0	1.4.13-r0
`mosquitto` Alpine:v3.11	before 1.4.13-r0	1.4.13-r0
`mosquitto` Alpine:v3.12	before 1.4.13-r0	1.4.13-r0
`mosquitto` Alpine:v3.13	before 1.4.13-r0	1.4.13-r0
`mosquitto` Alpine:v3.14	before 1.4.13-r0	1.4.13-r0
`mosquitto` Alpine:v3.15	before 1.4.13-r0	1.4.13-r0
`mosquitto` Alpine:v3.16	before 1.4.13-r0	1.4.13-r0
`mosquitto` Alpine:v3.17	before 1.4.13-r0	1.4.13-r0
`mosquitto` Alpine:v3.18	before 1.4.13-r0	1.4.13-r0
`mosquitto` Alpine:v3.19	before 1.4.13-r0	1.4.13-r0

Show 17 moreShow less

Affected packages
Package	Affected	Fixed
`mosquitto` Alpine:v3.20	before 1.4.13-r0	1.4.13-r0
`mosquitto` Alpine:v3.21	before 1.4.13-r0	1.4.13-r0
`mosquitto` Alpine:v3.22	before 1.4.13-r0	1.4.13-r0
`mosquitto` Alpine:v3.23	before 1.4.13-r0	1.4.13-r0
`mosquitto` Alpine:v3.24	before 1.4.13-r0	1.4.13-r0
`mosquitto` Alpine:v3.5	before 1.4.15-r0	1.4.15-r0
`mosquitto` Alpine:v3.6	before 1.4.15-r0	1.4.15-r0
`mosquitto` Alpine:v3.7	before 1.4.13-r0	1.4.13-r0
`mosquitto` Alpine:v3.8	before 1.4.13-r0	1.4.13-r0
`mosquitto` Alpine:v3.9	before 1.4.13-r0	1.4.13-r0
`mosquitto` Debian:12	before 1.4.14-1	1.4.14-1
`mosquitto` Debian:13	before 1.4.14-1	1.4.14-1
`mosquitto` Debian:14	before 1.4.14-1	1.4.14-1
`mosquitto` Debian:7	before 0.15-2+deb7u2, plus listed versions 0.15-20.15-2+deb7u1	0.15-2+deb7u2
`mosquitto` Debian:8	before 1.3.4-2+deb8u3, plus listed versions 1.3.4-21.3.4-2+deb8u11.3.4-2+deb8u2	1.3.4-2+deb8u3
`mosquitto` Ubuntu:14.04:LTS	before 0.15-2ubuntu1.2, plus listed versions 0.15-2ubuntu10.15-2ubuntu1.1	0.15-2ubuntu1.2
`mosquitto` Ubuntu:16.04:LTS	before 1.4.8-1ubuntu0.16.04.2, plus listed versions 1.4.3-11.4.4-11.4.7-11.4.8-11.4.8-1build11.4.8-1ubuntu0.16.04.1	1.4.8-1ubuntu0.16.04.2

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-9868 is a medium vulnerability (CVSS 5.5) in Eclipse Mosquitto, published June 25, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. Fixed in mosquitto 1.4.13-r0.

References

Show 15 moreShow less