CVE-2026-82180: CWE-295 Improper certificate validation in Eclipse Foundation Eclipse Arrowhead

In Eclipse Arrowhead versions 5.0.0 through 5.2.1, when the MQTT API is enabled with certificate authentication, the CertificateMqttFilter accepts an X.509 certificate sent inside the MQTT message payload and extracts the Subject DN as the authenticated identity. However, the certificate's signature is never verified, nor is its issuer chain validated against any trust store. Authorization is based solely on two string comparisons of attacker-controlled data: the DN-qualifier must be "sy" or "op", and the cloud-name part of the CN must match the server's cloud name, which is publicly known. An attacker able to publish to the MQTT broker can craft a self-signed certificate with CN=Sysop.<cloud>.<org>.arrowhead.eu and dnQualifier=op, thereby impersonating the cloud's system operator (isSysOp == true). This bypasses downstream authorization checks and grants full management access over MQTT. The HTTP CertificateFilter is unaffected as it relies on Tomcat's mTLS handshake and trust store validation.

An attacker with the ability to publish MQTT messages can impersonate a cloud system operator by forging a self-signed certificate with specific subject fields. This grants the attacker full management privileges over the MQTT interface of Eclipse Arrowhead, potentially allowing unauthorized control and configuration changes. The vulnerability does not affect HTTP-based certificate authentication, which remains secure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict MQTT broker publish permissions to trusted clients only and monitor MQTT usage for suspicious activity. Avoid enabling certificate authentication on MQTT unless necessary and ensure network-level controls prevent unauthorized MQTT publishing.