An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system configuration. …

CVE-2026-44091 describes a vulnerability where an unauthenticated remote attacker can post a malicious ID to an MQTT Broker, resulting in the creation of a new configuration entry in the system configuration. This attack requires no authentication, making it accessible to any remote attacker. The vulnerability may lead to both integrity and availability loss within the affected system. The issue is documented by CERT VDE under advisory VDE-2026-008. MQTT (Message Queuing Telemetry Transport) is a lightweight protocol commonly used in IoT and industrial control systems, making this vulnerability particularly concerning for critical infrastructure environments. The lack of authentication controls on the broker's ID handling represents a significant security gap. Successful exploitation could allow attackers to manipulate system configurations and potentially disrupt operations.