CVE-2026-85428
MOOS core-moos through 10.4.0 MOOSDB HTTP Server Unauthenticated Variable Write
CVSS 4.0 9.3 CRITICALCVSS 3.1 9.8 CRITICALCheck source for fixed versionsKEV status unknown
cve-program · CVE-2026-85428
PublishedMOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in the optional MOOSDB HTTP server that allows unauthenticated clients to write variables. Attackers can send HTTP requests with variable names and values to the MOOSDB HTTP server port to modify MOOS variables including actuator and override commands without authentication.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-85428 · CVE overview and exploitation status
cve-program · CVE-2026-85428
- https://github.com/themoos/core-moos/pull/77
- https://github.com/themoos/core-moos/commit/7e3aecdbf5fe47980ea9399340c77940991a6fa5
- https://github.com/themoos/core-moos
- https://github.com/themoos/core-moos/blob/ec9c77c68fcbdef8f5e4c60fe243acd223433f0c/Core/libMOOS/DB/HTTPConnection.cpp#L196
- https://www.vulncheck.com/advisories/moos-core-moos-through-10.4.0-moosdb-http-server-unauthenticated-variable-write
Related changes
Linked by CVE identifierNo related changes are available here.