Authentication Flaw in Eclipse Arrowhead's MQTT API Affecting Certificate Verification

CVE-2026-82180

What is CVE-2026-82180?

The vulnerability in Eclipse Arrowhead's MQTT API arises from inadequate verification of X.509 certificates during client authentication. When enabled with the certificate authentication policy, the system fails to validate the certificate’s signature and issuer chain against a trusted store. As a result, an attacker can craft a self-signed certificate with matching properties to bypass authentication checks, potentially gaining unauthorized access with full management capabilities over the MQTT broker. This weakness is specifically associated with the parsing mechanism in the CertificateMqttFilter, which relies solely on string comparisons of user-supplied data instead of robust security checks.

References