CVE-2026-92943

MQTT client skips hostname verification, allowing MITM with mismatched certs.

• CVSS 9.2
• 297
• Cryptographic
• Remote

Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject arbitrary MQTT messages that the device processes as authentic, via a certificate issued for an unrelated hostname by a certificate authority present in the device trust store. To remediate this issue, users should upgrade to version 1.6.1.

CVE

CVE-2026-92943

CWE

297

CVSS base score

9.2

Published

2026-09-17

OWASP

A02 Cryptographic Failures

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Cryptographic

Subcategory

Improper SSL/TLS Certificate Validation

Accessibility scope

Remote

Impact

Unauthorized Access

Affected component

AWS IoT Device SDK for Python

Fixed by upgrading

Yes

Solution

Upgrade the AWS IoT Device SDK for Python to version 1.6.1.

from AWSIoTPythonSDK.MQTTLib import AWSIoTMQTTClient

def connect_iot():
    client = AWSIoTMQTTClient("myDevice")
    client.configureEndpoint("a3q7example.iot.us-west-2.amazonaws.com", 8883)
    client.configureCredentials("/path/to/ca.pem", "/path/to/private.key", "/path/to/certificate.pem")
    # VULNERABLE: hostname not validated
    client.tls_insecure_set(True)
    client.connect()
    return client

from AWSIoTPythonSDK.MQTTLib import AWSIoTMQTTClient

def connect_iot():
    client = AWSIoTMQTTClient("myDevice")
    client.configureEndpoint("a3q7example.iot.us-west-2.amazonaws.com", 8883)
    client.configureCredentials("/path/to/ca.pem", "/path/to/private.key", "/path/to/certificate.pem")
    # FIX: enforce hostname validation
    client.tls_insecure_set(False)
    client.connect()
    return client

@misc{vaitp:cve202692943,
  title        = {{MQTT client skips hostname verification, allowing MITM with mismatched certs.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-92943},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-92943/}}
}