Eclipse Arrowhead CVE-2026-82180

Requires the Eclipse Arrowhead MQTT API to be enabled AND configured with the certificate authentication policy - this is the specific non-default deployment condition without which the vulnerable CertificateMqttFilter is never invoked. The attacker must be able to publish to the Arrowhead MQTT broker (network reachability to the broker plus any broker-level publish access). No prior Arrowhead authentication, credentials, or valid certificate is needed, and no user interaction is required; the only 'secret' inputs (cloud name, dnQualifier values) are public. Deployments using only the HTTP interface, or MQTT without the certificate authentication policy, are not exploitable via this path.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H, score 9.5) aligns well with the described impact: network-reachable, low-complexity, unauthenticated, yielding both confidentiality and integrity compromise plus a scope change into the managed systems. The AT:P (attack requirement present) metric correctly captures that this is not a default state - the MQTT API must be enabled AND set to the certificate authentication policy; deployments using only the HTTP interface are unaffected. There is no EPSS or CISA KEV data supplied, so exploitation status is 'no public exploit identified at time of analysis' - but the advisory documents a fully working forgery recipe, so weaponization difficulty is trivial for anyone who reads it. Because a successful bypass grants full sysop-level management over the local cloud, any organization running an exposed MQTT-enabled Arrowhead cloud should treat this as urgent rather than theoretical. The one genuine limiter is broker reachability and the non-default configuration; where those hold, this is a real priority, not a high-CVSS-but-low-real-risk finding.

An attacker with network access to the Arrowhead MQTT broker reads the target cloud's public name from its TLS certificate, then generates a self-signed X.509 certificate with CN=Sysop.<cloud>.<org>.arrowhead.eu and dnQualifier=op. They embed this certificate in the authentication field of an MqttRequestTemplate and publish a management request; CertificateMqttFilter accepts the unverified certificate, sets isSysOp==true, and the downstream ManagementServiceMqttFilter grants full management control over the local cloud. No proof-of-concept is publicly identified, but the advisory describes each step precisely.