In plain language
What this advisory means
The AWS IoT Device SDK for Python had a security flaw where it failed to properly check if a server's security certificate matched the expected AWS IoT Core endpoint name. Because of this, attackers on the same network could pretend to be the AWS IoT server, eavesdrop on device data, or send fake messages to the device. This vulnerability affected popular connection methods and requires users to upgrade the SDK to fix the issue.
Technical explanation
How the issue affects the environment
The MQTT client within the AWS IoT Device SDK for Python did not validate whether the TLS server certificate's hostname matched the AWS IoT Core endpoint hostname. On Python 3.7 and newer, a man-in-the-middle attacker with any CA certificate trusted by the device could present a certificate for an unrelated hostname. This allowed impersonation of the AWS IoT Core endpoint, enabling reading of telemetry and injection of arbitrary MQTT messages accepted as authentic by the device. Both X.509 mutual authentication over port 8883 and WebSocket with SigV4 over port 443 were affected, while the port 443 ALPN path was not.
Operational impact
Why teams should care
If exploited, attackers can intercept sensitive telemetry data from IoT devices, impacting data privacy and security. They can also inject unauthorized MQTT messages, potentially disrupting device operation or causing unsafe behaviors. This undermines the trustworthiness of connected IoT deployments, possibly leading to operational downtime, regulatory compliance issues, and reputational damage for organizations relying on AWS IoT services.
Immediate action
Upgrade the AWS IoT Device SDK for Python to version 1.6.1 or later, which includes the fix for proper hostname validation in TLS connections.
Affected and fixed releases
Temporary risk reduction
There is no workaround for this vulnerability. Users must upgrade to the fixed SDK version.
Evidence and validation checklist
- AWS Security Bulletin 2026-114-AWS published on 09/17/2026
- Description of the hostname mismatch in TLS validation in AWS IoT Device SDK for Python
- Impacted SDK connection paths: X.509 mutual authentication on port 8883 and WebSocket with SigV4 on port 443
- Resolution in version 1.6.1
- No workaround available
Authoritative reference
AWS Security Bulletins
QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.