Does Mosquitto allow anonymous MQTT connections by default?

It depends on version and configuration. In Mosquitto 2.0 and later you must choose authentication options explicitly before clients can connect, and anonymous access is off unless you turn it on. In earlier versions the default was to allow connections without authentication, so older brokers deserve a check.

What the documentation says

The Mosquitto authentication guide states that in version 2.0 and up you must choose your authentication options explicitly before clients can connect, while in earlier versions the default is to allow clients without authentication. It lists three choices: password files, authentication plugins, and unauthorised or anonymous access. You can combine them, and different listeners can use different methods when per_listener_settings is true.

The configuration manual describes allow_anonymous as controlling whether clients that connect without a username may connect. It defaults to false, with one exception: if no listeners are defined in the configuration file, it is set to true, but connections are allowed from the local machine alone.

So a modern broker with a listener defined and no extra settings refuses anonymous clients. A broker running with no listener defined accepts anonymous clients from the local machine alone. Neither is open to the internet by default, but a single line can change that.

How brokers end up open

Exposure usually comes from a deliberate change made to get something working:

• A developer adds allow_anonymous true to test a device, then ships the file.
• A listener is bound to all interfaces on a public host without any password or plugin.
• An old container image from before version 2.0 keeps running with default behaviour.
• A shared base configuration is copied into production unchanged.

Check your broker

1. Find the broker version with the version flag on the binary, or from your package or image tag.
2. Open the configuration file and any included directories. Search for allow_anonymous, listener, password_file, plugin and per_listener_settings.
3. From another machine, try connecting with no username using a test client. If it connects and can subscribe to a wildcard topic, anonymous access is on.
4. Check which interfaces and ports are reachable from outside your network.
5. Read the broker's log output for connection attempts from unknown addresses.

Decision table

The authentication guide notes that the dynamic security plugin can assign different rights to anonymous users than to authenticated ones, which may be useful for read access to data. That is a deliberate design, not an accident.

Authentication is not authorization

Even with logins required, every authenticated client may be able to read or write every topic unless you also set access control. The guide says that as well as authentication you should consider some form of access control to decide which clients can reach which topics. The next post covers topic ACL patterns based on username and client ID.

Also remember transport security. Passwords sent in clear text can be captured on the network, so use TLS on any listener reachable beyond a trusted segment.

Try it yourself

Click through it at your own pace, or open it full screen.

Look at how continuous monitoring flags changes, and think about alerting when a broker config changes.

Quick check

Safeguard scans your dependencies and SBOMs for known vulnerabilities, including the MQTT client and broker libraries you ship. A free scan is at gold.safeguard.sh/scan.

Sources

• Mosquitto Authentication Methods
• mosquitto.conf manual

Last reviewed: 19 October 2026.