CVE-2026-85432
MOOS core-moos through 10.4.0 MOOSDB Message Source Spoofing via Wire Identity
- State
- Published
- Severity
- 8.8 High
- Published
- Sep 3, 2026
- Updated
- Sep 4, 2026
- Reserved
- Sep 3, 2026
Description
MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers can forge message origins and cancel third-party subscriptions by exploiting the disconnect between authenticated connection identity and wire-supplied source attribution.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.8 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.2 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L | VulnCheck |
Weaknesses
- CWE-290 Authentication Bypass by Spoofing
Affected Products
| Product | Versions |
|---|---|
core-moosthemoos |
|
References
- Pull Request #76issue-trackingpatch
- Proposed fix commit (pull request not merged)patch
- https://github.com/themoos/core-moosproduct
- MOOSDB.cpp (verified sink)technical-description
- VulnCheck Advisory: MOOS core-moos through 10.4.0 MOOSDB Message Source Spoofing via Wire Identitythird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.