CVE-2026-92943

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-92943
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92943.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-92943
Aliases
  • GHSA-g7vp-3rxx-v25r
Published
2026-09-17T19:14:56Z
Modified
2026-09-19T03:47:27Z
Severity
  • 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python
Details

Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject arbitrary MQTT messages that the device processes as authentic, via a certificate issued for an unrelated hostname by a certificate authority present in the device trust store.

To remediate this issue, users should upgrade to version 1.6.1.

Database specific 
{
    "cna_assigner": "AMZN",
    "cwe_ids": [
        "CWE-297"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92943.json"
}
References

Affected packages

Git / github.com/aws/aws-iot-device-sdk-python

Affected ranges

Type
GIT
Repo
https://github.com/aws/aws-iot-device-sdk-python
Events
Introduced
3865ac9eec6274dac41f37cabd86e896e0e3bdbc
Fixed
52cfb0b4a819a381fc9eae6cee4d039daff158d8
Fixed
604b999f027a5f85ae32d3480dbf43cc194e6602
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.5.3"
        },
        {
            "fixed": "1.6.0"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.5.3
v1.5.4
v1.5.5
v1.6.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92943.json"