CVE-2026-85058

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers without invoking the authorizator.canWrite check used by normal PUBLISH paths. When anonymous access is enabled and topic ACLs restrict writes, a remote client can set an ACL-protected topic as the Last Will Topic during CONNECT and perform an abnormal client disconnect, causing the broker to inject attacker-controlled messages into a topic for which the client lacks write permission. This issue is fixed in version 0.18.1.

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers without invoking the authorizator.canWrite check used by normal PUBLISH paths. When anonymous access is enabled and topic ACLs restrict writes, a remote client can set an ACL-protected topic as the Last Will Topic during CONNECT and perform an abnormal client disconnect, causing the broker to inject attacker-controlled messages into a topic for which the client lacks write permission. This issue is fixed in version 0.18.1.

Summary

Moquette MQTT Broker fails to enforce ACL write permission checks when publishing Will (Last Will and Testament) messages on behalf of disconnected clients. All normal PUBLISH paths (receivedPublishQos0, receivedPublishQos1, receivedPublishQos2) correctly invoke authorizator.canWrite() before publishing, but the Will message publishing path (fireWill() → publishWill() → publish2Subscribers()) completely bypasses this authorization check.

This allows an unauthenticated attacker (when allow_anonymous=true, which is the default) to inject arbitrary messages into any ACL-protected topic by setting a restricted topic as the Will Topic in the CONNECT packet and then disconnecting abruptly via TCP RST.

Other major MQTT Broker implementations (Mosquitto, EMQX, HiveMQ) correctly enforce ACL checks on Will messages, confirming this is a bug, not a design choice.

Details

In the MQTT protocol, a client can declare a "Will" topic and message in the CONNECT packet. When the client disconnects abnormally (without sending a DISCONNECT packet), the Broker publishes the Will message on behalf of the client. Although the Will message content (topic and payload) is entirely controlled by the connecting client — making it functionally equivalent to a PUBLISH — Moquette skips the ACL check for this path.

Root Cause

File: broker/src/main/java/io/moquette/broker/PostOffice.java (v0.18.0)

Will publishing path (lines 286-328) — no canWrite() check:

public void fireWill(Session bindedSession) {
    final ISessionsRepository.Will will = bindedSession.getWill();
    if (will.delayInterval == 0) {
        publishWill(will);  // No canWrite() check!
    } else {
        trackWillSpecificationForFutureFire(...);
    }
}

private void publishWill(ISessionsRepository.Will will) {
    // ... build message ...
    publish2Subscribers(WILL_PUBLISKER, messageExpiryInstant, willPublishMessage);
    // No canWrite() check!
}

Normal PUBLISH path (line 641) — has canWrite() check:

if (!authorizator.canWrite(topic, username, clientID)) {
    LOG.error("client is not authorized to publish on topic: {}", topic);
    return;
}

Additionally, SessionRegistry.createNewWill() (line 408-428) stores the Will topic from the CONNECT packet without any canWrite() pre-check. The fireWill()/publishWill() method is the only publishing path that does not invoke authorizator.canWrite(), creating a complete authorization bypass.

Prerequisites

| Condition | Who controls | Default? | Notes | |-----------|-------------|----------|-------| | Attacker can establish MQTT connection to Broker | Environment | Yes | allow_anonymous defaults to true | | Broker has ACL restricting topic write access | Application | No | Only deployments with ACL configured have "bypass" significance, but this is a normal security deployment | | Client disconnects abnormally (TCP RST, not DISCONNECT) | Attacker | Yes | Attacker simply closes the TCP connection |

PoC

Verified against Moquette Broker v0.18.0 (latest release as of 2024-12-27). All scripts are included in the attached GitHub_Advisory_POC.zip. GitHub_Advisory_POC.zip

Environment Setup

Step 1: Download Moquette Broker v0.18.0

Download the official release bundle from GitHub and extract:

curl -L -o /tmp/moquette-0.18-bundle.tar.gz "https://github.com/moquette-io/moquette/releases/download/v0.18.0/distribution-0.18-bundle.tar.gz"
mkdir -p /tmp/moquette-0.18
tar xzf /tmp/moquette-0.18-bundle.tar.gz -C /tmp/moquette-0.18

Step 2: Configure ACL rules

Replace /tmp/moquette-0.18/config/acl.conf with the provided acl.conf (from POC zip), which contains:

# acl.conf - restrict write access to restricted/topic
topic write allowed/topic
topic read restricted/topic

Note: Must use topic rules (not pattern rules).…

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers without invoking the authorizator.canWrite check used by normal PUBLISH paths. When anonymous access is enabled and topic ACLs restrict writes, a remote client can set an ACL-protected topic as the Last Will Topic during CONNECT and perform an abnormal client disconnect, causing the broker to inject attacker-controlled messages into a topic for which the client lacks write permission. This issue is fixed in version 0.18.1.

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers without invoking the authorizator.canWrite check used by normal PUBLISH paths. When anonymous access is enabled and topic ACLs restrict writes, a remote client can set an ACL-protected topic as the Last Will Topic during CONNECT and perform an abnormal client disconnect, causing the broker to inject attacker-controlled messages into a topic for which the client lacks write permission. This issue is fixed in version 0.18.1.

Summary

Moquette MQTT Broker fails to enforce ACL write permission checks when publishing Will (Last Will and Testament) messages on behalf of disconnected clients. All normal PUBLISH paths (receivedPublishQos0, receivedPublishQos1, receivedPublishQos2) correctly invoke authorizator.canWrite() before publishing, but the Will message publishing path (fireWill() → publishWill() → publish2Subscribers()) completely bypasses this authorization check.

This allows an unauthenticated attacker (when allow_anonymous=true, which is the default) to inject arbitrary messages into any ACL-protected topic by setting a restricted topic as the Will Topic in the CONNECT packet and then disconnecting abruptly via TCP RST.

Other major MQTT Broker implementations (Mosquitto, EMQX, HiveMQ) correctly enforce ACL checks on Will messages, confirming this is a bug, not a design choice.

Details

In the MQTT protocol, a client can declare a "Will" topic and message in the CONNECT packet. When the client disconnects abnormally (without sending a DISCONNECT packet), the Broker publishes the Will message on behalf of the client. Although the Will message content (topic and payload) is entirely controlled by the connecting client — making it functionally equivalent to a PUBLISH — Moquette skips the ACL check for this path.

Root Cause

File: broker/src/main/java/io/moquette/broker/PostOffice.java (v0.18.0)

Will publishing path (lines 286-328) — no canWrite() check:

public void fireWill(Session bindedSession) {
    final ISessionsRepository.Will will = bindedSession.getWill();
    if (will.delayInterval == 0) {
        publishWill(will);  // No canWrite() check!
    } else {
        trackWillSpecificationForFutureFire(...);
    }
}

private void publishWill(ISessionsRepository.Will will) {
    // ... build message ...
    publish2Subscribers(WILL_PUBLISKER, messageExpiryInstant, willPublishMessage);
    // No canWrite() check!
}

Normal PUBLISH path (line 641) — has canWrite() check:

if (!authorizator.canWrite(topic, username, clientID)) {
    LOG.error("client is not authorized to publish on topic: {}", topic);
    return;
}

Additionally, SessionRegistry.createNewWill() (line 408-428) stores the Will topic from the CONNECT packet without any canWrite() pre-check. The fireWill()/publishWill() method is the only publishing path that does not invoke authorizator.canWrite(), creating a complete authorization bypass.

Prerequisites

| Condition | Who controls | Default? | Notes | |-----------|-------------|----------|-------| | Attacker can establish MQTT connection to Broker | Environment | Yes | allow_anonymous defaults to true | | Broker has ACL restricting topic write access | Application | No | Only deployments with ACL configured have "bypass" significance, but this is a normal security deployment | | Client disconnects abnormally (TCP RST, not DISCONNECT) | Attacker | Yes | Attacker simply closes the TCP connection |

PoC

Verified against Moquette Broker v0.18.0 (latest release as of 2024-12-27). All scripts are included in the attached GitHub_Advisory_POC.zip. GitHub_Advisory_POC.zip

Environment Setup

Step 1: Download Moquette Broker v0.18.0

Download the official release bundle from GitHub and extract:

curl -L -o /tmp/moquette-0.18-bundle.tar.gz "https://github.com/moquette-io/moquette/releases/download/v0.18.0/distribution-0.18-bundle.tar.gz"
mkdir -p /tmp/moquette-0.18
tar xzf /tmp/moquette-0.18-bundle.tar.gz -C /tmp/moquette-0.18

Step 2: Configure ACL rules

Replace /tmp/moquette-0.18/config/acl.conf with the provided acl.conf (from POC zip), which contains:

# acl.conf - restrict write access to restricted/topic
topic write allowed/topic
topic read restricted/topic

Note: Must use topic rules (not pattern rules).…