CVE-2026-85432

MOOS core-moos through 10.4.0 fails to validate client identity during MOOSDB message processing (CWE-290): the database trusts the source identifier carried inside serialized messages rather than binding it to the authenticated connection. An authenticated attacker can send messages that claim to come from any other registered client, forging message origins, and can disconnect or act under a victim's identity to cancel that victim's third-party subscriptions. The practical impact is loss of message integrity (downstream autonomy components consume data attributed to the wrong client) and limited availability loss through cancelled subscriptions; confidentiality is not affected per the CVSS scoring. Any deployment running MOOSDB from core-moos 10.4.0 or earlier is affected, which in practice means robotics and autonomous maritime/vehicle platforms and research autonomy stacks built on MOOS. No public proof-of-concept, in-the-wild exploitation, or KEV listing is known, and EPSS puts 30-day exploitation probability at roughly 0.3%.

What to do: Inventory environments running MOOSDB from core-moos 10.4.0 or earlier and check the MOOS project for a patched release beyond 10.4.0, upgrading as soon as one is published (no fixed version is stated in the available data). Until patched, restrict MOOSDB access to trusted, authenticated peers on isolated networks, and log or alert on subscription cancellations and on messages whose source name does not match the authenticated connection. Treat message source attribution from MOOSDB as untrusted in downstream autonomy logic.