CVE-2026-33356: Meari MQTT broker missing per-device subscribe ACL
In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to global wildcard topics and receive telemetry from devices the user does not own. The broker enforces publish restrictions but does not enforce equivalent subscribe authorization at per-device scope.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33356?
CVE-2026-33356 has been rated with a critical severity due to its potential to expose sensitive telemetry data.
How do I fix CVE-2026-33356?
To fix CVE-2026-33356, update your Meari IoT Cloud MQTT Broker or EMQX version to the latest release that implements proper per-device subscribe access controls.
Who is affected by CVE-2026-33356?
Any users of Meari IoT Cloud MQTT Broker or EMQX versions 4.x are affected by CVE-2026-33356.
What types of accounts are impacted by CVE-2026-33356?
Any authenticated low-privilege accounts can exploit CVE-2026-33356 to subscribe to unrestricted global wildcard topics.
What is the impact of CVE-2026-33356?
The impact of CVE-2026-33356 allows unauthorized users to receive telemetry data from devices they do not own, potentially compromising user privacy.