Is CVE-2026-33356 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33356 being exploited in the wild.

How severe is CVE-2026-33356?

High severity, with a CVSS score of 7.7, published 11 May 2026.

Is there a fix for CVE-2026-33356?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-33356 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-33356?

Check whether you run EMQX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33356: Meari IoT Cloud MQTT Broker authorization bypass in EMQX 4.x

CVE-2026-33356 · Severity: high · CVSS 7.7 · Published 2026-05-11

Meari IoT Cloud uses an MQTT broker to manage communications between smart home devices, such as security cameras, and their owners. A security flaw allows any registered user to bypass privacy controls and subscribe to data streams belonging to other customers. An attacker could use this to monitor platform-wide device activity, access alert metadata, and obtain links to private camera images, leading to large-scale surveillance and data exposure.

Vendors: EMQX.

Quick answers

Is CVE-2026-33356 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33356 being exploited in the wild.
How severe is CVE-2026-33356?: High severity, with a CVSS score of 7.7, published 11 May 2026.
Which products and versions are affected?: EMQX EMQX 4.x.
Is there a fix for CVE-2026-33356?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-33356 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-33356?: Check whether you run EMQX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Meari IoT Cloud MQTT Broker, specifically deployments utilizing EMQX 4.x, fails to enforce proper Access Control Lists (ACLs) for subscription requests at a per-device scope. While the broker correctly restricts publishing, it allows any authenticated low-privilege account to subscribe to global wildcard topics (e.g., using '#' or '+'). This vulnerability, classified as CWE-639 (Authorization Bypass Through User-Controlled Key), enables an attacker to ingest platform-wide event streams. This includes sensitive telemetry such as device identifiers, alert metadata, and URLs to camera artifacts, which can be further used to facilitate follow-on attacks. The vulnerability is reachable over the network and requires only a standard user account.

Affected products

Meari IoT Cloud MQTT Broker (EMQX 4.x) EMQX 4.x

Timeline

2026-03-11: disclosed: Issues identified by researcher and disclosed to vendor
2026-04-03: other: VINCE Case VU#579666 opened with CISA for tracking
2026-05-11: advisory: Public disclosure of CVE-2026-33356

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.