CVE-2026-49198: MQTT Broker Auth Bypass Vulnerability

CVE-2026-49198 Overview

CVE-2026-49198 is an improper access control vulnerability [CWE-284] in an MQTT broker implementation. The broker permits authenticated clients to subscribe to wildcard topics without authorization checks. This allows any low-privileged client to receive every message published across the broker, exposing all MQTT traffic to unauthorized actors.

The issue affects the broker's subscription handling logic, where wildcard filters such as # and + bypass topic-level access controls. Attackers with valid low-privilege credentials can harvest telemetry, control messages, and sensitive payloads from unrelated tenants or devices.

Critical Impact
A single authenticated client can subscribe to # and silently capture all MQTT traffic flowing through the broker, including device telemetry and control commands from other tenants.

Affected Products

MQTT broker referenced in the Acer Community Article
Specific affected product versions are not enumerated in the NVD record
Refer to the vendor advisory for the authoritative affected component list

Discovery Timeline

2026-05-29 - CVE-2026-49198 published to the National Vulnerability Database
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2026-49198

Vulnerability Analysis

Message Queuing Telemetry Transport (MQTT) brokers route messages from publishers to subscribers based on topic filters. The protocol supports two wildcard characters: + for single-level matches and # for multi-level matches. Brokers must enforce access control lists (ACLs) on both publish and subscribe operations, including when wildcards are used.

In this broker, the subscription handler validates client authentication but does not evaluate ACL rules against wildcard subscriptions. An authenticated client with minimal privileges can issue a SUBSCRIBE request for # and receive every message routed through the broker. This breaks the tenancy and topic isolation that downstream applications assume.

The weakness aligns with CWE-284 (Improper Access Control). The flaw is exploitable over the network with low privileges and no user interaction. Confidentiality impact is high while integrity and availability are unaffected, since the attacker only reads traffic.

Root Cause

The broker's authorization layer evaluates topic ACLs against literal topic strings but skips expansion of wildcard filters. As a result, a wildcard subscription is treated as a single allowed topic rather than as a request that would match every topic on the broker.

Attack Vector

An attacker obtains or is issued a low-privilege MQTT account. The attacker connects to the broker over TCP or TLS and sends a SUBSCRIBE packet containing a wildcard such as # or a coarse pattern like +/+/telemetry. The broker delivers all matching messages to the attacker for as long as the session remains open.

No exploitation code is required beyond a standard MQTT client. Technical details are described in the Acer Community Article.

Detection Methods for CVE-2026-49198

Indicators of Compromise

MQTT SUBSCRIBE packets containing # or top-level + wildcards originating from accounts that should be scoped to a specific device or tenant topic
Long-lived MQTT sessions with unusually high inbound message volume relative to the client's expected role
Connections from IP addresses or client IDs that do not match the inventory of provisioned devices or services

Detection Strategies

Enable broker-side audit logging for all SUBSCRIBE operations and alert on wildcard filters at the root or near-root level
Correlate subscription patterns against an allowlist of expected topic filters per client identity
Inspect TLS-terminated MQTT traffic at a gateway and flag wildcard subscriptions that violate tenant boundaries

Monitoring Recommendations

Track per-client message delivery rates and alert when a client receives messages from topics outside its provisioned scope
Monitor authentication logs for newly created or recently reused MQTT credentials immediately followed by wildcard subscriptions
Forward broker logs to a centralized analytics platform for retention and correlation with endpoint and identity telemetry

How to Mitigate CVE-2026-49198

Immediate Actions Required

Apply the vendor update referenced in the Acer Community Article as soon as it is available for your deployment
Audit all MQTT accounts and revoke credentials that are not actively required
Rotate credentials for any account that may have been used to issue wildcard subscriptions during the exposure window

Patch Information

Consult the Acer Community Article for the authoritative remediation guidance, fixed component versions, and configuration changes required to enforce topic-level authorization on wildcard subscriptions.

Workarounds

Configure broker ACLs to deny # and top-level + subscriptions for all non-administrative accounts
Segment tenants onto dedicated brokers or namespaces so that a wildcard subscription cannot cross trust boundaries
Place the broker behind a policy-enforcing MQTT gateway that rewrites or rejects unauthorized wildcard subscription requests
Require mutual TLS authentication and bind client certificates to specific topic prefixes

bash

# Example Mosquitto-style ACL restricting a device account to its own topic tree
user device-042
topic readwrite devices/0042/#
# Explicitly deny broad wildcards for non-admin roles
pattern deny read #
pattern deny read +/#