Eclipse Mosquitto bug bounty programs
mosquitto.org Updated
Eclipse Mosquitto runs one public program: a Sorona bug bounty paying up to $1,500.
- Top reward
- $1,500
- Sorona
- Programs
- 1
- 1 pays cash
- Targets in scope
- 12
- 2 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program Eclipse Mosquitto runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Eclipse Mosquitto
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
12 targets. 6 excluded.
-
https://mosquitto.org
Web
-
Authentication and authorisation end to end: password files, TLS client certificates, pre-shared keys and the plugin authentication interface
Products and areas
-
Bridge mode, where one broker connects to another as a client and parses whatever the remote side sends back
Products and areas
-
libmosquitto, the client library a great deal of device firmware links against, plus the mosquitto_pub and mosquitto_sub command-line clients
Products and areas
-
MQTT 5.0 property handling: user properties, topic aliases, subscription identifiers and the response-topic machinery
Products and areas
-
Session and message persistence, covering retained messages, queued QoS 1 and QoS 2 messages, will messages and the on-disk database the broker writes
Products and areas
-
The $SYS topic tree and anything else that exposes broker state to a connected client
Products and areas
-
The dynamic security plugin and the broker's plugin ABI, where an external module makes authorisation decisions on the broker's behalf
Products and areas
-
The Eclipse Foundation vulnerability reporting policy accepts security issues in any Eclipse project and the research behind this entry found no Mosquitto-specific carve-out, so the whole tree is the declared target rather than a narrow asset list
Products and areas
-
The MQTT packet parser across both 3.1.1 and 5.0, covering CONNECT, PUBLISH, SUBSCRIBE and every other control packet the broker reads before a client is authenticated
Products and areas
-
TLS listener handling, including certificate processing, SNI, ALPN and the WebSockets listener
Products and areas
-
Topic matching and the wildcard engine, along with the access control lists that decide who may publish or subscribe to what
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 6
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Broker configurations an administrator chose, such as running with anonymous access allowed or without TLS on a public interface
-
Client applications and vendor firmware that merely speak MQTT to a Mosquitto broker
-
Denial of service that amounts to sending the broker more traffic than the hardware can carry
-
Other MQTT brokers. EMQX, NanoMQ, HiveMQ and VerneMQ are separate codebases under separate vendors and separate policies, and EMQ's own policy states that reports will be rewarded
-
Reports filed as public GitHub issues rather than through the Eclipse intake
-
Upstream dependency defects such as OpenSSL, unless Mosquitto's own use of the library is what makes them reachable
Recent changes
Reward and scope changes across every Eclipse Mosquitto program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under mosquitto.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.