External risk intelligence

MQTT Broker Missing Authentication Allows Full Device Compromise.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-44090

The vulnerability affects an MQTT broker which the bulletin explicitly states is protected from external access by a firewall. While MQTT is a network protocol, it is typically deployed within internal or isolated networks, making direct public internet exposure uncommon in standard configurations.

Missing Authentication

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in an MQTT broker that, if exploited, could allow an unauthenticated remote attacker to gain full control of a device. While the technology is protected by a firewall, the missing authentication mechanism presents a significant risk should that protection be bypassed. The primary concern for leadership is confirming if this technology is in use and potentially exposed.

Unauthenticated access to MQTT broker poses a risk.
Critical vulnerability impacts device security and control.
Confirm relevance and exposure; assess potential impact.

Attack Path

How an attacker could exploit the issue

An attacker could reach a vulnerable MQTT broker if it's exposed to the internet, even if protected by a firewall. Once accessed, the lack of authentication allows the attacker to interact with the broker. This interaction could lead to a full compromise of the device.

Unauthenticated remote access to exposed MQTT broker.
Interaction with the MQTT broker.
Full device compromise.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated remote attacker could access an MQTT broker that is only protected by a firewall. This could lead to a full compromise of the affected device.

Device access and control at risk.
Exploits missing authentication over network.
Full device compromise may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects an MQTT broker that is protected from external access by a firewall, suggesting that infrastructure or platform teams managing the broker and its network security are likely responsible. The first practical step is to identify all instances of the affected MQTT broker, confirm its actual exposure beyond the firewall, assess its business criticality, and then determine the accountable owner to plan remediation.

Infrastructure or platform teams own the issue.
Verify broker exposure and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the MQTT broker affected by CVE-2026-44090?

An MQTT broker acts as a central hub for messaging between internet-connected devices, handling data transmission in automation and sensor networks. This specific component is the core software that manages these communications, and the vulnerability means it currently lacks the necessary access controls to verify who or what is sending commands to it.

What does CWE-306 mean for CVE-2026-44090?

CWE-306 refers to a Missing Authentication for Critical Function weakness. In the context of this CVE, it means the software fails to verify the identity of a user or system attempting to connect to the broker. Because there is no login or credential check, anyone who can reach the broker over the network is automatically granted full access to the device's functions and data.

How can an attacker trigger this vulnerability?

An attacker triggers this by initiating a network connection directly to the MQTT broker. Since authentication is missing, no specific payload or credential is required. It is important to note that sending traffic to devices behind a properly configured, restrictive firewall may prevent the attacker from reaching the broker in the first place, serving as a layer of defense.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal labels this as Unlikely, noting that MQTT brokers are typically designed for internal or isolated network environments rather than public internet exposure. If your broker is restricted by a firewall and is not exposed to the public internet, the direct risk is significantly reduced compared to systems that are openly accessible.

How should I respond to this vulnerability?

Start by locating all instances of this MQTT broker within your infrastructure to understand where it is running. Once identified, verify if the broker is accessible from the internet or if it is adequately segmented behind firewalls. Finally, consult with the team managing that specific network or device to prioritize securing the connection and removing any unnecessary public-facing access.

References

www.certvde.com/en/advisories/VDE-2026-008/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.