CVE-2026-69658
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
MQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information to network-level attackers. This may enable unauthorized device impersonation and disruption of messaging functions.
Risk Assessment
The organization is at risk of credential interception and control data exposure, potentially leading to device takeover and communication disruption.
Recommendation
Implement encryption for MQTT traffic (e.g., TLS) and enforce client authentication.
Other vulnerabilities in MQTT
See all- CVE-2026-22535High
An attacker with network access and valid credentials can, due to the unsecured (unencrypted) MQTT protocol, write to server topics on the board controlling MQTT communications.
- CVE-2026-49199Critical
Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the target device.
Original NVD description (English source)
MQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information to network-level attackers. This may enable unauthorized device impersonation and disruption of messaging functions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS