CVE-2018-20145: Eclipse Mosquitto

High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days.

Eclipse Mosquitto 1.5.x before 1.5.5 allows ACL bypass: if the option per_listener_settings was set to true, and the default listener was in use, and the default listener specified an acl_file, then the acl file was being ignored.

Affected products

• Eclipse Mosquitto: from 1.5, before 1.5.5 (fixed in 1.5.5)

Published 2018-12-13. Last modified 2026-06-17.