CVE-2026-85424: Missing Authentication for Critical Function in themoos core-moos

CVE-2026-85424 describes a missing authentication vulnerability in the MOOS core-moos wire protocol up to version 10.4.0. The lack of authentication enables unauthenticated clients to connect with full privileges, including publish, subscribe, and database clearing capabilities. Attackers can circumvent compile-time protocol string checks and impersonate arbitrary client names to perform privileged operations, notably the DB_CLEAR command that resets all variables and clears client mail queues. This vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity.

An attacker can connect to the core-moos service without authentication and execute privileged operations, including clearing the entire database and client mail queues. This can lead to denial of service by resetting all variables and disrupting normal operations dependent on the database state and messaging queues.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Until a patch is available, restrict network access to the core-moos service to trusted clients only and monitor for unauthorized connections.