Vulnerability · Published Sep 3, 2026 · Assigned by VulnCheck
CVE-2026-85428MOOS core-moos through 10.4.0 MOOSDB HTTP Server Unauthenticated Variable Write
Critical 9.8
In plain English
A critical-severity missing authentication in core-moos from themoos. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.8%top 42.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
MOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in the optional MOOSDB HTTP server that allows unauthenticated clients to write variables. Attackers can send HTTP requests with variable names and values to the MOOSDB HTTP server port to modify MOOS variables including actuator and override commands without authentication.
Affected products (as reported)
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- Pull Request #77 issue-tracking, patch
- Proposed fix commit (pull request not merged) patch
- https://github.com/themoos/core-moos product
- HTTPConnection.cpp (verified sink) technical-description
- VulnCheck Advisory: MOOS core-moos through 10.4.0 MOOSDB HTTP Server Unauthenticated Variable Write third-party-advisory