# CVE-2026-33356: Meari IoT Cloud MQTT Broker authorization bypass in EMQX 4.x

Source: https://junglewise.ai/threats/cve-2026-33356-meari-iot-cloud-mqtt-broker-authorization-bypass-in-emqx-4-x  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-33356 · Severity: high · CVSS 7.7 · Published 2026-05-11

Meari IoT Cloud uses an MQTT broker to manage communications between smart home devices, such as security cameras, and their owners. A security flaw allows any registered user to bypass privacy controls and subscribe to data streams belonging to other customers. An attacker could use this to monitor platform-wide device activity, access alert metadata, and obtain links to private camera images, leading to large-scale surveillance and data exposure.

Vendors: [EMQX](https://junglewise.ai/threats/vendors/emqx).

## Quick answers

**Is CVE-2026-33356 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33356 being exploited in the wild.

**How severe is CVE-2026-33356?** High severity, with a CVSS score of 7.7, published 11 May 2026.

**Which products and versions are affected?** EMQX EMQX 4.x.

**Is there a fix for CVE-2026-33356?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-33356 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-33356?** Check whether you run EMQX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Meari IoT Cloud MQTT Broker, specifically deployments utilizing EMQX 4.x, fails to enforce proper Access Control Lists (ACLs) for subscription requests at a per-device scope. While the broker correctly restricts publishing, it allows any authenticated low-privilege account to subscribe to global wildcard topics (e.g., using '#' or '+'). This vulnerability, classified as CWE-639 (Authorization Bypass Through User-Controlled Key), enables an attacker to ingest platform-wide event streams. This includes sensitive telemetry such as device identifiers, alert metadata, and URLs to camera artifacts, which can be further used to facilitate follow-on attacks. The vulnerability is reachable over the network and requires only a standard user account.

## Affected products

- Meari IoT Cloud MQTT Broker (EMQX 4.x) EMQX 4.x

## Timeline

- 2026-03-11: disclosed: Issues identified by researcher and disclosed to vendor
- 2026-04-03: other: VINCE Case VU#579666 opened with CISA for tracking
- 2026-05-11: advisory: Public disclosure of CVE-2026-33356

## References

- [https://github.com/xn0tsa/nobody-puts-baby-in-a-corner](https://github.com/xn0tsa/nobody-puts-baby-in-a-corner)
- [https://www.runzero.com/advisories/meari-mqtt-broker-missing-per-device-subscribe-acl-cve-2026-33356/](https://www.runzero.com/advisories/meari-mqtt-broker-missing-per-device-subscribe-acl-cve-2026-33356/)

## Related threats

- [EMQX race condition in QoS 2 PUBLISH Packet Handler](https://junglewise.ai/threats/cve-2026-8741-emqx-race-condition-in-qos-2-publish-packet-handler)