CVE-2026-92943

CVSS 9.2 (critical) · published 2026-09-17

Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject arbitrary MQTT messages that the device processes as authentic, via a certificate issued for an unrelated hostname by a certificate authority present in the device trust store. To remediate this issue, users should upgrade to version 1.6.1.

Weakness: CWE-297

Source: NVD CVE-2026-92943

References

• https://aws.amazon.com/security/security-bulletins/2026-114-aws/
• https://github.com/aws/aws-iot-device-sdk-python/releases/tag/v1.6.1
• https://github.com/aws/aws-iot-device-sdk-python/security/advisories/GHSA-g7vp-3rxx-v25r
• https://pypi.org/project/AWSIoTPythonSDK/1.6.1/

Check your software

Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.