Skip to content
CVE PROGRAM SOURCE RECORD6.6 Medium

CVE-2026-44725

EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute grant lifetime or SHA-256 package binding. An attacker with a compromised dashboard administrator credential or API key with plugin-install permission who finds a stale allowed name and version can upload attacker-controlled bytes under the allowed .tar.gz filename through POST /api/v5/plugins/install or the dashboard plugin upload. The broker then installs and runs attacker-controlled Erlang code with the privileges of the EMQX process. This issue is fixed in versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

emqx emqx

  • < 5.8.11affected
  • >= 5.9.0, < 5.9.3affected
  • >= 5.10.0, < 5.10.4affected
  • >= 6.0.0, < 6.0.3affected
  • >= 6.1.0, < 6.1.2affected
  • >= 6.2.0, < 6.2.1affected

References