CVE-2026-49186: MQTT Broker Auth Bypass Vulnerability

CVE-2026-49186 Overview

CVE-2026-49186 describes a missing authentication weakness in a local Message Queuing Telemetry Transport (MQTT) broker. The broker does not enforce topic-level Access Control Lists (ACLs), allowing any authenticated client to subscribe to any topic. Attackers can use MQTT wildcard subscriptions (# or +) to enumerate hidden network devices and intercept telemetry. The same gap enables publication of rogue control commands to topics that should be restricted. The vulnerability maps to [CWE-287] Improper Authentication and carries network-based exploitability with high impact across confidentiality, integrity, and availability of broker-managed devices.

Critical Impact
Any client connected to the MQTT broker can enumerate connected devices and publish unauthorized control messages, leading to full compromise of broker-mediated device communication.

Affected Products

Acer products referenced in Acer Community Support Article 19707
Devices relying on the affected local MQTT broker for command and telemetry messaging
Downstream IoT clients subscribing to broker topics without independent authorization

Discovery Timeline

2026-06-04 - CVE-2026-49186 published to the National Vulnerability Database (NVD)
2026-06-04 - Last updated in NVD database

Technical Details for CVE-2026-49186

Vulnerability Analysis

The MQTT protocol uses a publish-subscribe model in which clients subscribe to topic filters and a broker routes messages between publishers and subscribers. Topic-level ACLs determine which clients may publish or subscribe to specific topic patterns.

The affected broker authenticates clients at connection time but applies no per-topic authorization. Once a session is established, the broker accepts any SUBSCRIBE or PUBLISH packet regardless of the topic filter requested. This violates the principle of least privilege expected from MQTT deployments handling device control traffic.

The impact spans three areas. Confidentiality fails because subscribers receive telemetry intended for other clients. Integrity fails because attackers can publish forged commands. Availability fails because rogue commands can place devices into invalid states or trigger reboot loops.

Root Cause

The broker configuration omits ACL enforcement for topic patterns. Authentication is treated as sufficient authorization, with no mapping between client identifiers and permitted topics. The flaw aligns with [CWE-287] Improper Authentication because the authorization layer assumes authentication results equate to topic-level permission.

Attack Vector

An attacker with broker access sends a SUBSCRIBE packet using the multi-level wildcard # to receive every message routed through the broker. The single-level wildcard + enables targeted enumeration of device identifiers in structured topic hierarchies such as home/+/status. The attacker then issues PUBLISH packets to control topics to deliver crafted commands to devices. Network reachability to the broker port (typically TCP 1883 or 8883) is the only precondition beyond valid client credentials.

No verified exploitation code is published for this CVE. Refer to the Acer Community Support Article for vendor-supplied technical details.

Detection Methods for CVE-2026-49186

Indicators of Compromise

MQTT SUBSCRIBE packets containing the # wildcard at the root of the topic hierarchy
Single client identifiers subscribing to large numbers of unrelated topic branches
PUBLISH traffic on control topics originating from clients that historically only consumed telemetry
Unexpected device state changes correlated with new broker client sessions

Detection Strategies

Enable broker audit logging for CONNECT, SUBSCRIBE, and PUBLISH packets and forward logs to a central analytics platform
Baseline expected topic patterns per client identifier and alert on deviations such as wildcard subscriptions
Inspect MQTT traffic at the network layer for wildcard subscription requests from non-administrative clients
Correlate device command events with the originating MQTT client to identify unauthorized publishers

Monitoring Recommendations

Monitor broker connection counts and per-client topic cardinality for sudden increases
Track MQTT ports (1883, 8883) for inbound connections from unmanaged hosts
Alert on any subscription request matching the regular expression ^#$ or topic filters beginning with #
Review broker process logs for repeated PUBLISH attempts to topics outside a client's expected scope

How to Mitigate CVE-2026-49186

Immediate Actions Required

Restrict network access to the MQTT broker to known device subnets using host or network firewall rules
Rotate MQTT client credentials and remove any shared or default accounts
Deploy topic-level ACLs that map each client identifier to the minimum set of permitted publish and subscribe patterns
Disable anonymous client connections on the broker configuration

Patch Information

No dedicated patch identifier is published in the NVD record for CVE-2026-49186. Consult the Acer Community Support Article for vendor remediation guidance and firmware updates that introduce ACL enforcement.

Workarounds

Place the broker behind a reverse proxy that enforces topic authorization independently of the broker
Segment IoT devices onto a dedicated VLAN with no routing to user workstations
Require Transport Layer Security (TLS) with client certificates and bind certificates to permitted topics at a policy enforcement point
Replace the affected broker with a hardened MQTT broker that supports ACL files or external authorization plugins

bash

# Example Mosquitto ACL configuration enforcing topic-level authorization
# /etc/mosquitto/acl.conf
user device01
topic readwrite home/device01/#

user dashboard
topic read home/+/status

# /etc/mosquitto/mosquitto.conf
allow_anonymous false
password_file /etc/mosquitto/passwd
acl_file /etc/mosquitto/acl.conf