High severity · published May 11, 2026
CVE-2026-33359
Meari unauthenticated alert image access in cloud object storage
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
In Meari IoT Cloud alert image storage on Alibaba OSS (latest observed; storage service version not disclosed), motion snapshots are retrievable without authentication, signed URLs, or expiry enforcement. URLs function as direct object references and remain valid beyond expected operational windows.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AO
Alibaba OSS Hosted · Meari
April, 2026 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33359
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-33359
github.com
https://github.com/xn0tsa/nobody-puts-baby-in-a-corner
www.runzero.com
https://www.runzero.com/advisories/meari-unauthenticated-alert-image-access-in-cloud-object-storage-cve-2026-33359/