An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system… (CVE-2026-44091)
An unauthenticated remote attacker can send a malicious ID to the MQTT Broker, causing the creation of a new configuration entry in the system configuration. This vulnerability may lead to loss of system integrity and availability. No patch or remediation information is currently provided. The vulnerability is classified as high severity based on the impact described.
AI Analysis
Technical Summary
This vulnerability (CVE-2026-44091) allows an unauthenticated remote attacker to post a malicious ID to an MQTT Broker, resulting in the creation of unauthorized configuration entries within the system. This unauthorized configuration modification can compromise system integrity and availability. The vulnerability is identified as CWE-501 (Logic/Time Bomb). No information about affected versions or available patches is provided in the current data.
Potential Impact
Successful exploitation can lead to unauthorized changes in system configuration, potentially disrupting system operations and causing integrity and availability loss. There is no evidence of known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the MQTT Broker to trusted entities and monitor for unusual configuration changes if possible.
An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system… (CVE-2026-44091)
Description
An unauthenticated remote attacker can send a malicious ID to the MQTT Broker, causing the creation of a new configuration entry in the system configuration. This vulnerability may lead to loss of system integrity and availability. No patch or remediation information is currently provided. The vulnerability is classified as high severity based on the impact described.
CVSS v4.0
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-44091) allows an unauthenticated remote attacker to post a malicious ID to an MQTT Broker, resulting in the creation of unauthorized configuration entries within the system. This unauthorized configuration modification can compromise system integrity and availability. The vulnerability is identified as CWE-501 (Logic/Time Bomb). No information about affected versions or available patches is provided in the current data.
Potential Impact
Successful exploitation can lead to unauthorized changes in system configuration, potentially disrupting system operations and causing integrity and availability loss. There is no evidence of known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the MQTT Broker to trusted entities and monitor for unusual configuration changes if possible.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-pwf7-5xmc-7x99
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-44091"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a6b72bb9c2644c7f8473cb6
Added to database: 07/30/2026, 15:50:19 UTC
Last enriched: 07/30/2026, 20:07:50 UTC
Last updated: 07/31/2026, 03:32:06 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.