Moquette-io - Moquette - CRITICAL - CVE-2026-85724. Moquette, a lightweight Java MQTT broker, has a security issue prior to version 0.18.1 where improperly configured pattern-based Access Control List (ACL) rules can lead to unintended access control. When %c or %u placeholders are used directly in rules, a client can manipulate its identity containing special characters like + or #, thus broadening the access granted and allowing cross-tenant read and write operations. This flaw may also result in an invalid MQTT topic filter causing a NullPointerException, potentially disrupting session processing. This critical issue highlights the necessity of properly securing client identities and upgrading to version 0.18.1 for a fix.