MQTT is a critical protocol enabling communication for inexpensive hardware, with the broker being its central, often overlooked component. A ZoomEye index query on October 23, 2026, revealed over 5.6 million MQTT service matches. Restricting this to the conventional port 1883 still showed 4.7 million matches, indicating a significant number of brokers on other ports that could be missed by port-specific queries.The broker's role is significant due to MQTT's permissive authentication defaults, designed for constrained devices. Brokers often ship with anonymous access and non-TLS connections enabled for convenience during commissioning. This can lead to significant exposure.An anonymous client subscribing to a broker's "#" topic can access the entire telemetry stream, revealing sensitive operational data in industrial settings. Even more concerning is anonymous publishing, which allows clients to write values that downstream systems, such as building management or supervisory control layers, might act upon.The 5.6 million matches do not specify how many accept anonymous connections or are honeypots, but they highlight a vast installed base with permissive configurations. This underscores the need for organizations to assess their own MQTT deployments for potential exposure.A recommended query plan for a network includes running specific search queries, attempting anonymous connections, and checking for data leakage via the "#" topic. It's also crucial to verify TLS encryption, as plaintext telemetry transmission is a separate vulnerability. Finally, administrative interfaces of brokers like Mosquitto, EMQX, and HiveMQ should be assessed independently for additional exposures.The permissive defaults of MQTT are a design choice, not a flaw, enabling a broad ecosystem. However, this flexibility places the burden on operators to properly configure brokers, and the high number of exposed instances reflects the cost of not revisiting these configurations.