Researcher reports pre-auth RCE in Eclipse Mosquitto WebSocket listener
A researcher reports a pre-auth RCE in Eclipse Mosquitto 2.1.x WebSocket, and Home Assistant add-on users should update to 7.1.2 or later.
- Published
- Ecosystem
- Open source
- Fixed in
- Home Assistant Mosquitto add-on 7.1.2 or later; no fixed upstream Mosquitto release yet (not confirmed)
- Exploitation
- No evidence in the source of in-the-wild exploitation; the researcher describes their own proof-of-concept work only
What happened
According to a write-up by the researcher “born0monday” on born0monday.me, a bug in Eclipse Mosquitto’s built-in WebSocket handling can be exploited for unauthenticated (pre-auth) remote code execution. The author claims this is possible in Home Assistant’s Mosquitto add-on container. This is one researcher’s account. The source does not show independent verification.
The author says the flaw was publicly disclosed in a GitHub issue in August 2026 and is still unpatched upstream. They say that issue wrongly concluded the bug has no memory-safety impact. The author says they found it independently about a week earlier while researching the Home Assistant Green for Pwn2Own Ireland 2026, and that the public disclosure made it ineligible for the competition.
The author says they found the bug by fuzzing, which produced an out-of-bounds heap write reachable before authentication. In their technical description, the packet reader in stage C assumes the transport read function never returns more bytes than are still needed. They say the WebSocket read function, net__read_ws, breaks that assumption when it handles an empty WebSocket frame. In that case header-parsing steps overwrite the returned length with the number of bytes consumed, and those reads are not bounded by the caller’s count. The excerpt of the post available to us is truncated, so the full exploit chain is not confirmed here.
The post is the first of two parts. The author says the second part will cover escalating the foothold to full device compromise through a container escape. That part is not covered by the available source.
The author’s update of 5 November 2026 says Eclipse is working on fixed upstream releases, expected before 18 November.
Am I affected?
Per the author’s Affected section on born0monday.me:
- Eclipse Mosquitto (upstream): versions 2.1.x (2.1.0 onwards) built with the built-in WebSocket listener (
WITH_WEBSOCKETS=yes) and exposing it on the network. There is no fixed release yet. - Home Assistant Mosquitto add-on: versions 7.1.1 and earlier in the default configuration. The author says it is fixed in 7.1.2, released 19 October 2026.
The author says the Home Assistant add-on container exposes tcp/1884 to the network for MQTT-over-WebSocket, and that this is the entry point they used.
Not confirmed in the source: a CVE identifier, any official severity rating or CVSS score, any exploitation in the wild, and any confirmation from Eclipse or Nabu Casa beyond the author’s own statement about upstream work. The “medium” severity label on this advisory is not a rating from the source or from a vendor. It reflects the cap this site applies when only a single researcher’s claim is available and no official advisory supports a higher level. If an official advisory later rates the issue, this label should be revisited.
What to do now
- If you use the Home Assistant Mosquitto add-on, check its version and update to 7.1.2 or later, as the author recommends.
- If you run upstream Mosquitto 2.1.x built with the built-in WebSocket listener, restrict or firewall the WebSocket port until a fixed release exists, as the author advises.
- If you do not need MQTT-over-WebSocket, disable the built-in WebSocket listener, as the author advises.
- Watch for the upstream Eclipse Mosquitto releases that the author says are expected before 18 November, and update when they appear. The release details are not confirmed.