External risk intelligence

MOOSDB HTTP Server Authentication Bypass Allows Unauthenticated Variable Writes

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-85428

The vulnerability affects an optional HTTP server component within MOOSDB. While the component is network-accessible, MOOS is typically used for autonomous vehicle and robotics messaging, meaning it is generally deployed in isolated or internal research and development environments rather than being exposed directly to the public internet.

Missing Authentication

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in the optional MOOSDB HTTP server that could allow unauthenticated access to modify critical system variables. This means unauthorized parties might be able to alter commands or settings without needing any credentials. While the affected component is network-accessible, its typical deployment in research or internal environments suggests the main concern is confirming whether this specific technology is in use and exposed within our operations.

Allows unauthorized system variable changes.
Matters if we use this specific messaging software.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could target the optional MOOSDB HTTP server to bypass authentication and write variables. This could allow them to modify critical MOOS variables, including commands for actuators and overrides, without needing any credentials.

Network access to the HTTP server is required.
Unauthenticated HTTP requests trigger the vulnerability.
Allows unauthorized modification of commands.

Live Threat

Current exploitation, exposure, and threat context

The MOOSDB HTTP server's optional authentication bypass vulnerability could allow an unauthenticated attacker to modify MOOS variables. This could affect actuator commands and override commands that control system behavior, as these are communicated as MOOS variables.

Actuator and override commands at risk.
Modification via unauthenticated HTTP requests.
Potential for unauthorized system control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The MOOSDB HTTP server component is susceptible to an authentication bypass, allowing unauthenticated attackers to write variables. Real-world ownership likely falls to the application or platform teams responsible for the MOOS deployment, with initial triage focusing on identifying all instances of the MOOSDB HTTP server, confirming its network exposure, and assessing business criticality. Coordination with vendor-management may be necessary if the affected component is part of a third-party integration.

Application or platform teams own the issue.
Verify MOOSDB HTTP server exposure and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MOOS core-moos?

MOOS (Mission Oriented Operating Suite) is a middleware framework commonly used in robotics and autonomous underwater vehicles. It provides a messaging architecture where nodes exchange data via a central database, MOOSDB. This software manages communication between various vehicle sensors and controllers, serving as the connective tissue that allows complex robotic systems to process data and execute missions in real-time.

How does CVE-2026-85428 impact MOOSDB?

This vulnerability is an authentication bypass (CWE-306). It specifically affects the optional HTTP server feature within MOOSDB. Because the server fails to verify identity, it essentially treats any incoming network request as trusted. An attacker can send specially crafted HTTP packets to inject or change MOOS variables, which directly control system parameters like actuator commands, without needing a login or password.

Does any network traffic trigger this vulnerability?

The vulnerability is triggered specifically by HTTP requests sent to the MOOSDB HTTP server port. It does not occur if the HTTP server component is disabled in your MOOS configuration. Furthermore, standard MOOS inter-process messaging that does not utilize this specific optional HTTP interface remains unaffected by this particular authentication bypass flaw.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal notes that while the MOOSDB HTTP server is network-accessible, the software is usually deployed in isolated research or robotics environments rather than on the public internet. However, you should still care if your internal network architecture allows unauthorized segments or devices to reach this component. Assess whether your MOOS instances are reachable by unintended parties within your internal infrastructure.

What is the first step to address this CVE?

Begin by identifying all active instances of the MOOSDB HTTP server within your environment. Verify whether the optional HTTP interface is strictly necessary for your operations. If it is not required, disabling the HTTP server is the most effective way to eliminate the attack surface. If you must keep it enabled, ensure that access to the associated port is restricted to authorized systems only via network segmentation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.