Pub/sub exposure on the public internet: what teams are missing

TL;DR: MQTT, ZeroMQ and NATS services are often exposed to the public internet without authentication, with more than 28k MQTT servers, 9,491 ZeroMQ publisher sockets and 3,979 unauthenticated NATS hosts observed, according to Censys research. The governance gap is not protocol novelty but invisible internal messaging becoming externally reachable before anyone notices.

Editorial analysis by NHI Mgmt Group, based on content published by Censys: “Unauthenticated Message Queues are a Problem”.

By the numbers:

• more than 28k MQTT servers
• 9,491 ZeroMQ publisher sockets
• 3,979 unauthenticated NATS hosts

Key questions

Q: How should security teams govern unauthenticated pub/sub services on the internet?

A: Treat public messaging endpoints as governed assets, not hidden implementation details.

Q: Why do exposed MQTT, ZeroMQ and NATS services create security risk?

A: They collapse the boundary between internal system traffic and public reachability.

Q: What are the signs that internal messaging is exposed too broadly?

A: Look for public IPs, cloud security groups, open broker ports, default or absent authentication, and topics that accept subscriptions from unknown clients.

Practitioner guidance

• Inventory all externally reachable messaging endpoints Scan for MQTT, ZeroMQ and NATS services across public ranges, cloud assets and on-prem networks, then record protocol, socket type, authentication state and ownership in the asset register.
• Require authentication for every pub/sub consumer Block unauthenticated subscriptions and publisher access by default, then allow only explicitly approved identities, topics and transport paths for production messaging.
• Review message content for sensitive operational data Classify topics and streams that carry telemetry, credentials, location data, logs or device commands, and remove secrets or personal data from streams that do not need them.

Bottom line: Publicly exposed pub/sub services can leak live operational data even when they are not traditional web applications.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →