A bug in Eclipse Mosquitto, one of the world's most widely used open-source message brokers for smart-home and industrial devices, can be exploited without logging in to gain remote code execution, a security researcher has shown.

The flaw sits in Mosquitto's built-in WebSocket listener. A single empty WebSocket frame confuses the broker's packet handling, causing a memory error that a remote attacker can turn into code execution before authentication. The researcher demonstrated the attack against the broker running inside Home Assistant's official Mosquitto add-on.

The underlying fault was first reported publicly as GitHub issue 3704 on 10 August, when it was judged to have no memory-safety impact. The researcher, writing under the name born0monday, showed that assessment was wrong and reported the full impact to the Eclipse Foundation on 20 August. Eclipse closed the report as a duplicate on 28 October without a fix.

Mosquitto versions 2.1.0 and later built with the built-in WebSocket listener are affected when that listener is exposed on a network. No CVE has been assigned. Eclipse is working on fixed releases, expected before 18 November.

Home Assistant users are already protected if they run Mosquitto add-on 7.1.2 or later, released on 19 October. Others should firewall the WebSocket port or disable the built-in WebSocket listener until a fixed upstream release arrives.