CVE-2026-33359: Meari unauthenticated alert image access in cloud object storage

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-11 · updated 2026-10-26
Weakness: CWE-862

Description

In Meari IoT Cloud alert image storage on Alibaba OSS (latest observed; storage service version not disclosed), motion snapshots are retrievable without authentication, signed URLs, or expiry enforcement. URLs function as direct object references and remain valid beyond expected operational windows.

Affected products

Meari Alibaba OSS Hosted: April, 2026

References

https://github.com/xn0tsa/nobody-puts-baby-in-a-corner
https://www.runzero.com/advisories/meari-unauthenticated-alert-image-access-in-cloud-object-storage-cve-2026-33359/

Get alerted when CVE-2026-33359 or the next vulnerability affects your stack