MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers can forge message origins and cancel third-party subscriptions by exploiting the disconnect between authenticated connection identity and wire-supplied source attribution.
References
| Link | Resource |
|---|---|
| https://github.com/themoos/core-moos | Product |
| https://github.com/themoos/core-moos/blob/ec9c77c68fcbdef8f5e4c60fe243acd223433f0c/Core/libMOOS/DB/MOOSDB.cpp#L748 | Issue Tracking |
| https://github.com/themoos/core-moos/commit/26308f0e393f0e80bfa09b275891e776b8dbf522 | Issue Tracking Patch |
| https://github.com/themoos/core-moos/pull/76 | Issue Tracking Patch |
| https://www.vulncheck.com/advisories/moos-core-moos-through-10.4.0-moosdb-message-source-spoofing-via-wire-identity | Third Party Advisory |
Configurations
History
14 Oct 2026, 14:43
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:themoos:core-moos:*:*:*:*:*:*:*:* | |
| First Time |
Themoos core-moos
Themoos |
|
| References | () https://github.com/themoos/core-moos - Product | |
| References | () https://github.com/themoos/core-moos/blob/ec9c77c68fcbdef8f5e4c60fe243acd223433f0c/Core/libMOOS/DB/MOOSDB.cpp#L748 - Issue Tracking | |
| References | () https://github.com/themoos/core-moos/commit/26308f0e393f0e80bfa09b275891e776b8dbf522 - Issue Tracking, Patch | |
| References | () https://github.com/themoos/core-moos/pull/76 - Issue Tracking, Patch | |
| References | () https://www.vulncheck.com/advisories/moos-core-moos-through-10.4.0-moosdb-message-source-spoofing-via-wire-identity - Third Party Advisory |
Information
Published : 2026-09-03 23:17
Updated : 2026-10-14 14:43
NVD link : CVE-2026-85432
Mitre link : CVE-2026-85432
CVE.ORG link : CVE-2026-85432
JSON object : View
Products Affected
themoos
- core-moos
CWE
CWE-290
Authentication Bypass by Spoofing