CVE-2026-85432
MOOS core-moos through 10.4.0 MOOSDB Message Source Spoofing via Wire Identity
Published Sep 3, 2026 · updated Oct 14, 2026 · themoos core-moos
MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers can forge message origins and cancel third-party subscriptions by exploiting the disconnect between authenticated connection identity and wire-supplied source attribution.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Sep 3, 2026 · NIST NVD
Detected
MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers can forge message origins and cancel third-party subscriptions by exploiting the disconnect between authenticated connection identity and wire-supplied source a
Oct 14, 2026 · NIST NVD
Updated
MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers can forge message origins and cancel third-party subscriptions by exploiting the disconnect between authenticated connection identity and wire-supplied source a
Affected
- cpe themoos/core-moosversion unspecified
- vendor themoos core-moosversion unspecified
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2026-85432
MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers can forge message origins and cancel thi
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2026-85432
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-85432
30-day exploitation probability 0.5%
first.org - NIST NVDVulnerability recordCVE-2026-85432
MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers can forge message origins and cancel thi
nvd.nist.gov