External risk intelligence

MOOS Core Missing Authentication in Wire Protocol Allows Database Clear

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-85424

MOOS-core is a specialized middleware framework used primarily in autonomous vehicle and robotics research. While it uses a network-based wire protocol, it is designed for internal, low-latency communication between components on local subnets or private robotic networks, making public internet exposure uncommon and contrary to typical deployment patterns.

Missing Authentication

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

The MOOS core middleware has a vulnerability that allows unauthorized access to its services. This could enable an attacker to reset critical system data or interrupt communications without needing any credentials. The main concern at this time is confirming if this specific technology is in use within our environment.

Unauthorized access to core system functions.
Potentially impacts data integrity and operational continuity.
Confirm relevance and exposure within our systems.

Attack Path

How an attacker could exploit the issue

An attacker can bypass the intended security checks of the MOOS wire protocol to connect to the system without any authentication. Once connected, they can issue commands to clear the entire database and message queues, potentially disrupting the system's operation.

No authentication required.
Privileged operations can be triggered.
Disruption of system data and queues.

Live Threat

Current exploitation, exposure, and threat context

The MOOS core wire protocol lacks authentication, potentially allowing unauthenticated network clients to connect and execute privileged operations. This could lead to the clearing of all database variables and message queues.

System data and service behavior.
Unauthenticated network access.
Service disruption and data loss.

Operational Fix

Recommended remediation, mitigation, and detection steps

The MOOS core-moos middleware is likely managed by platform or development teams responsible for the robotic or autonomous systems it supports. The first practical step is to identify all instances of MOOS core-moos, determine their network exposure and criticality, and then locate the accountable owners for remediation planning.

Platform or development teams own resolution.
Verify MOOS network exposure and criticality.
Plan coordinated remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MOOS-core used for?

MOOS-core is a middleware framework designed to facilitate communication between different software components. It is commonly used in robotics and autonomous vehicle research to manage data exchange, allowing separate processes to publish information and subscribe to updates across a system.

What does CWE-306 mean for CVE-2026-85424?

CWE-306 refers to a Missing Authentication for Critical Function vulnerability. In the context of this CVE, it means the MOOS wire protocol does not verify the identity of anyone trying to connect. Because there is no check, the system treats every connection request as valid, allowing unauthorized users to issue commands with full administrative privileges.

How does an attacker trigger this vulnerability?

An attacker triggers this by initiating a network connection to the MOOSDB process using the system's wire protocol. Since the protocol lacks authentication, the attacker does not need credentials or a specific pre-existing relationship with the system. Simply establishing a connection is sufficient to gain full access; however, legitimate local traffic or non-networked internal system calls are not the target of this specific network-based flaw.

Is my system at risk if it runs MOOS-core?

Halo Surface Signal indicates that public internet exposure for this technology is unlikely because it is typically deployed on private, low-latency robotic or local networks. You should prioritize assessing systems that bridge these private segments with broader networks, as the vulnerability relies on reachability over the wire protocol to execute unauthorized commands.

What are the first steps to secure MOOS-core?

Begin by identifying all deployments of MOOS-core within your environment. Consult with the platform or development teams who manage these autonomous or robotic systems to determine where this middleware is active. Once identified, evaluate the network accessibility of these instances and coordinate with the owners to plan for updates or restricted network access, as the immediate priority is understanding where the technology resides in your infrastructure.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.