CVE-2017-7650: In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id...

Security readout for executives and security teams

Older Mosquitto MQTT brokers can mishandle pattern-based access rules. A client may be able to bypass intended topic restrictions, exposing messages or publish paths that ACLs were meant to protect. The issue matters most where Mosquitto controls operational, IoT, or customer messaging data. Exposure is likely limited to organizations running Mosquitto before 1.4.12, especially deployments using pattern ACLs or third-party auth/access-control plugins. Internet-facing MQTT brokers or brokers shared by multiple tenants are higher concern. Treat as a targeted remediation item for MQTT environments, not a broad enterprise emergency. Prioritize externally reachable brokers, shared messaging platforms, and systems carrying operational or customer-sensitive telemetry. Mitigation focus: Upgrade Mosquitto to 1.4.12 or later, using vendor-supported packages where available.; Review Debian or operating-system security advisories for patched package versions.; Audit third-party Mosquitto authentication and access-control plugins for equivalent wildcard identity handling..

Prepared

Jun 12, 2026, 21:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.