Skip to content
Threat Feed
Subscribe

Tag

Mqtt

4 briefs RSS
critical advisory

Unauthenticated Remote Access to Phoenix Contact CHARX SEC MQTT Broker

A critical vulnerability (CVE-2026-44090) in Phoenix Contact CHARX SEC controllers allows unauthenticated remote attackers to gain full device control by bypassing authentication on the MQTT broker.

CHARX SEC-3150 +7 industrial-control-systems mqtt cve-2026-44091 ics cve injection authentication-bypass cve-2026-44100 +14
2r 5t 12c
high threat

NATS Server Authorization Bypass Vulnerability (CVE-2026-58252)

CVE-2026-58252 identifies an authorization bypass vulnerability in NATS Server, described as a 'Subscribe Authz Bypass via Wildcard-Overlap', which allows unauthorized access or actions by exploiting how wildcard subscriptions are handled.

exploited NATS Server authorization-bypass cve nats server vulnerability mqtt information-disclosure filter-bypass +1
2t 1c
high advisory

NATS.io MQTT ACL Bypass Vulnerability

A vulnerability in NATS.io versions before v2.12.6 or v2.11.15 allows MQTT clients to bypass ACL checks for MQTT subjects due to ACLs not being applied in the `$MQTT.>` namespace, potentially allowing unauthorized access and control of MQTT communications.

NATS server nats.io mqtt acl-bypass vulnerability
2r 1t
high advisory

NATS Server MQTT Password Disclosure Vulnerability

The NATS server exposes MQTT passwords in plaintext via monitoring endpoints due to incorrect classification as JWTs, affecting versions before v2.12.6 or v2.11.15.

NATS server nats mqtt credential-access vulnerability
3r 1t