CVE-2026-92943: Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python
Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject arbitrary MQTT messages that the device processes as authentic, via a certificate issued for an unrelated hostname by a certificate authority present in the device trust store.
To remediate this issue, users should upgrade to version 1.6.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AWS IoT Device SDK for Pythonto a version that resolves this vulnerability.Fixed in 1.6.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using AWS IoT Device SDK for Python versions 1.5.3 through 1.6.0 on Python 3.7 or later are affected. Exploitation depends on the device trust store containing a certificate authority that has issued a certificate for an unrelated hostname.
What must an attacker be able to do to exploit it?
The attacker must act as an adversary in the middle of the device's MQTT TLS connection and present a certificate for an unrelated hostname that chains to a certificate authority trusted by the device. No device-side privileges or user interaction are required.
What could a successful attacker do?
An attacker could impersonate the AWS IoT Core endpoint, read device telemetry, and inject arbitrary MQTT messages that the device treats as authentic.
How should affected deployments be remediated?
Upgrade the AWS IoT Device SDK for Python to version 1.6.1.