Live › vulnerability › GHSA-g7vp-3rxx-v25r
Go to dashboardThe AWS IoT Device SDK for Python did not verify that the server certificate matched the AWS IoT Core hostname in its MQTT TLS connection. An attacker positioned on the network can present a certificate for another hostname signed by any trusted CA, read device telemetry and inject MQTT messages the device treats as genuine.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 19:43 UTC. All times on this page are UTC.
Devices and gateways using the SDK's default MQTT connection paths are exposed: X.509 mutual authentication on port 8883 and WebSocket with SigV4 on port 443 (the ALPN path on 443 was not affected). The risk is an on-path attacker on the device's network, so devices on shared or untrusted networks matter most.
No product ranges from the sources yet.
pip show AWSIoTPythonSDK and confirm whether it falls in >=1.5.3 and <=1.6.0 on Python 3.7 or later.1.6.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-92943 - Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python
Bulletin ID: 2026-114-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/17/2026 12:00 PM PDT
Description:
AWS IoT Device SDK for Python (AWSIoTPythonSDK) is an open source SDK that lets IoT devices and gateways connect to AWS IoT Core over MQTT. We identified CVE-2026-92943 in the MQTT client TLS connection layer, where the client did not validate that the server certificate matched the AWS IoT Core endpoint hostname. On Python 3.7 and later, an adversary-in-the-middle positioned on the network could present a certificate issued for an unrelated hostname by any certificate authority in the device trust store, impersonate the AWS IoT Core endpoint, read device telemetry, and inject arbitrary MQTT messages that the device processes as authentic. Both SDK default connection paths were affected: X.509 mutual authentication on port 8883 and WebSocket with SigV4 on port 443. The port 443 ALPN path was not affected.
Impacted versions: >=1.5.3 AND <=1.6.0 (on Python 3.7 and later)
Resolution:
This issue has been addressed in AWSIoTPythonSDK version 1.6.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
There is no workaround. The affected connection paths are the SDK's documented defaults. Customers must upgrade to version 1.6.1.
References:
Acknowledgement:
We would like to thank George Chen for collaborating on this issue through the coordinated vulnerability disclosure process.
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("GHSA-g7vp-3rxx-v25r")