CVE-2026-49186

CriticalCVSS 9.8

Published: 04/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

24th percentile - higher than 24% of all known CVEs

Summary

The local MQTT broker does not enforce topic-level Access Control Lists (ACLs). Any client can subscribe using wildcard characters (# or +) to enumerate hidden network devices or publish rogue control commands.

Risk Assessment

An attacker can access sensitive data from network devices or send rogue commands, potentially disrupting system operation.

Recommendation

Configure topic-level ACLs for MQTT or update the broker to a patched version.

Original NVD description (English source)

The local MQTT broker does not enforce topic-level Access Control Lists (ACLs). This allows any client to subscribe using wildcard characters (# or +) to enumerate hidden network devices or publish rogue control commands.