Pwning Home Assistant Green: Pre-Auth RCE in Eclipse Mosquitto
In this writeup I’m going to demonstrate that a seemingly benign bug in Eclipse Mosquitto, publicly disclosed back in August 2026 and still unpatched upstream, can in fact be exploited to gain unauthenticated (pre-auth) RCE. The GitHub issue1 incorrectly concluded that the bug has no impact on memory safety. I had found the flaw independently about a week earlier while researching the Home Assistant Green for Pwn2Own Ireland 20262, but the public disclosure made it ineligible for the competition. This writeup also includes advisory information for affected users. See the Affected section below. ...