CVE-2026-95848 is a fail open flaw in the Moquette Java MQTT broker before version 0.18.1, rated 9.1. If a configured authenticator or authorizator class cannot be loaded, the broker starts with authentication or authorization disabled instead of stopping. Upgrade to 0.18.1.
What's affected
- Product: Moquette, a lightweight Java MQTT broker (Maven artifact io.moquette:moquette-broker).
- Affected: versions before 0.18.1.
- Fixed: 0.18.1. The GitHub advisory also lists 0.19.0 as patched.
- Trigger: a misspelled class name, a missing dependency, a constructor failure or a classpath problem for the custom authenticator or authorizator.
How to check if you're exposed
Find the Moquette version your build resolves:
mvn dependency:tree | grep -i moquette
./gradlew dependencies | grep -i moquette
Then check your own broker. Look at the startup log for errors about loading your authenticator or authorizator class. A load error followed by a normal start is the exact situation this CVE describes. Finally, test from a client that has no credentials. A broker that is configured for authentication should refuse it.
What to do now
- Upgrade to Moquette 0.18.1 or later and redeploy the broker.
- Confirm your authenticator and authorizator class names in the configuration, and that their dependencies are on the classpath.
- After each deploy, run a smoke test that connects without credentials and checks that the broker rejects the connection.
- Review broker logs and topic activity from any period when the broker may have started without its controls.
- Keep the broker off the public internet unless it needs to be there, and place it behind a firewall.
Why it matters
The record lists CWE-636, not failing securely. The code treats a failed load as if nothing had been configured and falls back to accepting everyone. That turns a deployment typo into an open broker, and the operator sees a healthy service. The vector is network based with no privileges, and scores high for confidentiality and integrity.
The advisory page that covers this fix is a broader one. It also describes an authorization bypass and denial of service issues fixed in the same release line, and notes that Moquette is reachable by untrusted MQTT clients. That is one more reason to upgrade rather than only fix your configuration. The record does not mark the CVE as exploited in the wild.
Quick check
Can I avoid this by checking my configuration carefully?
It helps, but a classpath or dependency change can break the load later without any config change. Upgrade, and keep a startup test that proves authentication is enforced.
Sources
Last reviewed: 19 October 2026.
