CVE-2026-50085 is a high severity (CVSS 8.6) missing authentication flaw in the Aqara Board service, a cloud service. It accepted MQTT command payloads and forwarded them to the platform broker without a login. runZero says the vendor reported the issue fixed on 20 April 2026.
What's affected
- Product: Aqara Board service at op-test.aqara.com, a vendor-hosted service.
- Affected versions: not applicable, since the service is run by the vendor.
- Fixed: per runZero's timeline, the vendor stated the issue was fixed on 20 April 2026. Public disclosure was 12 June 2026.
- Weakness: CWE-306, missing authentication for a critical function.
- CVSS 8.6 (high), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L. - Not marked as exploited in CISA KEV.
runZero calls this the last step of a four step chain with CVE-2026-50083, CVE-2026-50082 and CVE-2026-50084, ending in a command surface for smart locks, cameras, hubs and sensors.
How to check if you're exposed
This is a vendor-hosted cloud service, so there is no package or version for you to check. The runZero advisory's timeline says the vendor reported the issue fixed on 20 April 2026, before the public disclosure on 12 June 2026.
What you can do on your side:
- Confirm that your Aqara devices and apps are on current versions from the official app stores and the vendor.
- Review your Aqara account for devices, automations, shares or logins you do not recognize.
- Check the vendor's support pages for any statement about this disclosure.
What to do now
- Update the Aqara app and any hub or device firmware to the latest versions the vendor offers.
- Review the devices, rooms, automations and shared users on your Aqara account and remove anything you do not recognize.
- Change your account password and enable any extra sign-in protection the app offers.
- If you run these devices in a business, add the platform to your vendor risk list and ask Aqara for a written statement on remediation.
- Keep smart locks, cameras and hubs on a separate network segment from computers that hold sensitive data.
Why it matters
MQTT is the message bus many smart home platforms use to send commands to devices. A service that takes a message from anyone and passes it to the broker is effectively a remote control with no lock. The advisory describes a debug interface that behaved that way and lists other weak settings on the same service.
The weakness class is CWE-306. Debug and test endpoints should be removed from production or protected like any other privileged function. The service name in the record also hints at a test environment reachable from the internet, which is a good prompt to inventory your own externally reachable test hosts.
Quick check
Why does a High score matter if the chain was needed?
Chains are how real incidents happen. Each link gets a score of its own, and defenders should close each one.
Sources
- runZero advisory
- Researcher write-up (named in the CVE record; not fetched)
- Safeguard Gold entry
Last reviewed: 19 October 2026.
