An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system configuration. …

CVE-2026-44091 describes a vulnerability where an unauthenticated remote attacker can post a malicious ID to an MQTT Broker, resulting in the creation of a new configuration entry in the system configuration. This attack requires no authentication, making it trivially exploitable by remote attackers. The vulnerability can lead to both integrity and availability loss of the affected system. It affects systems utilizing MQTT Broker functionality. The issue has been reported via NVD and CERT VDE advisory VDE-2026-008. The ability to inject configuration entries could allow persistent manipulation of system behavior. No authentication barrier exists to prevent exploitation, increasing the attack surface significantly.