CVE-2026-44091

Deferred Deferred - Pending Action

Unauthenticated Configuration Manipulation in MQTT Broker

Publication date: 2026-07-30

Last updated on: 2026-07-31

Assigner: CERT VDE

Description

An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system configuration. This may lead to integrity and availability loss.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-31

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-44091

EUVD

EUVD-2026-51026

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-501	The product mixes trusted and untrusted data in the same data structure or structured message.

Attack-Flow Graph

Executive Summary

This vulnerability allows an unauthenticated remote attacker to send a malicious ID to an MQTT Broker, which then creates a new configuration entry in the system. This can lead to loss of data integrity and system availability.

Detection Guidance

Detecting this vulnerability requires monitoring MQTT Broker logs for unauthorized configuration changes. Check for unexpected new entries in system configuration files. Use network monitoring tools to inspect MQTT traffic for malformed or suspicious ID posts. Commands like 'mosquitto_sub -t '#' -v' can log MQTT messages for analysis.

Impact Analysis

An attacker could exploit this to alter system configurations, disrupt services, or cause system failures. This may result in unauthorized changes, data corruption, or denial of service.

Compliance Impact

This vulnerability could lead to violations of integrity and availability requirements in GDPR and HIPAA. Unauthorized changes or disruptions may result in non-compliance with data protection and security standards.

Mitigation Strategies

Immediately restrict unauthenticated access to the MQTT Broker and enforce authentication for all connections. Monitor configuration changes and disable dynamic entry creation if possible.

Hi! I’m here to help you understand CVE-2026-44091. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70