Cyber & AI intelligence
Wasteland.
Briefs indexed2403
Issues26
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-85428 2026-09-03

CVE-2026-85428: Unauthenticated Variable Write in MOOS MOOSDB HTTP Server

"A critical authentication bypass in MOOS core-moos through version 10.4.0 lets unauthenticated network clients write MOOS variables, including actuator and override commands, directly through the optional MOOSDB HTTP…"

A critical authentication bypass in MOOS core-moos through version 10.4.0 lets unauthenticated network clients write MOOS variables, including actuator and override commands, directly through the optional MOOSDB HTTP server.

What Is It

MOOS core-moos ships an optional HTTP server built into MOOSDB, the central variable database that MOOS processes use to publish and subscribe to data. That HTTP server performs no authentication on write operations. An attacker who can reach the MOOSDB HTTP server port can send an HTTP request carrying a variable name and value, and MOOSDB will accept the write.

The issue is tracked as CWE-306 (Missing Authentication for Critical Function). The reporter assigned a base score of 9.3 (Critical) under CVSS 4.0.

The published vector string, CVSS:4.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, does not match that label: it carries a CVSS:4.0 prefix but is assembled from CVSS 3.1 metrics. CVSS 4.0 dropped scope (S) and replaced the single C/I/A impact triad with separate vulnerable-system (VC/VI/VA) and subsequent-system (SC/SI/SA) metrics, plus an attack requirements metric (AT). The vector as published is therefore not a valid CVSS 4.0 string, and it should be treated as unreliable until the source corrects it. The 9.3 figure is itself consistent with a CVSS 4.0 scoring of the equivalent metrics, a CVSS 3.1 vector of those same values would score 9.8, so the score, not the string, is the better guide here.

In substance, the metrics describe the same conditions either way: network-reachable, low attack complexity, no privileges required, no user interaction, with high confidentiality, integrity, and availability impact.

Why It Matters

MOOS variables are not inert configuration. The advisory specifically calls out that an attacker can modify actuator and override commands. In a MOOS deployment, that is the control path; writing those variables is equivalent to issuing commands to whatever the MOOS instance is driving. No credentials, no prior access to the MOOSDB, and no user interaction are required; a single well-formed HTTP request to an exposed port is enough.

What's Vulnerable

The vulnerable write path is in Core/libMOOS/DB/HTTPConnection.cpp.

Patch Status

CISA has not added CVE-2026-85428 to the Known Exploited Vulnerabilities catalog, and no KEV entry or KEV-mandated remediation date applies. No confirmation of active exploitation is present in the supplied data.

A fix exists upstream: commit 7e3aecd in the themoos/core-moos repository, submitted as pull request #77. Operators running 10.4.0 or earlier should apply that change, and, where patching is not immediate, disable the optional MOOSDB HTTP server or restrict access to its port at the network layer.

Sources