CVE-2026-49186: Lack of MQTT Broker Topic Access Control Lists
The local MQTT broker does not enforce topic-level Access Control Lists (ACLs). This allows any client to subscribe using wildcard characters (# or +) to enumerate hidden network devices or publish rogue control commands.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enable and configure topic-level Access Control Lists on the MQTT broker to explicitly allow or deny publish/subscribe per client/topic. Explicitly deny use of wildcard subscriptions (# and +) for clients that are not authorized, and create per-client/topic rules to restrict access to sensitive topics.
MQTT broker topic-level ACLs = enabled - Compensating control
Restrict network access to the MQTT broker using firewall rules, network segmentation, or ACLs so only trusted hosts/networks can connect to the broker; place the broker behind a gateway or broker-facing firewall to reduce exposure while topic-level ACLs are implemented.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49186?
CVE-2026-49186 is classified as high severity with a score of 8.6.
How do I fix CVE-2026-49186?
To mitigate CVE-2026-49186, implement topic-level Access Control Lists (ACLs) on your MQTT broker to restrict unauthorized access.
What are the potential impacts of CVE-2026-49186?
CVE-2026-49186 can allow unauthorized clients to subscribe to hidden topics, exposing sensitive network device information or enabling rogue command publications.
Which software is affected by CVE-2026-49186?
CVE-2026-49186 affects the Acer Connect M6e 5g Firmware.
When was CVE-2026-49186 published?
CVE-2026-49186 was published on June 4, 2026.