CVE-2026-82180

Name of the Vulnerable Software and Affected Versions Eclipse Arrowhead versions 5.0.0 through 5.2.1

Description When the MQTT API is enabled with the certificate authentication policy, the CertificateMqttFilter parses an X.509 certificate provided by the client within the authentication field of the MqttRequestTemplate and uses its Subject DN as the authenticated identity. The certificate is decoded using CertificateFactory.generateCertificate(), but the system fails to verify the signature or validate the issuer chain against a trust store. Authorization is limited to two string comparisons on attacker-supplied data: the DN-qualifier must be "sy" or "op", and the cloud-name part of the Common Name (CN) must match the server's. Since these values are public, an attacker can use a self-signed certificate to be authenticated as the cloud's system operator, bypassing the ManagementServiceMqttFilter and gaining full management access over MQTT.

Recommendations Update Eclipse Arrowhead to a version later than 5.2.1. As a temporary mitigation, disable the MQTT API or the certificate authentication policy until the software is updated.