CVE-2026-44725
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution
EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute grant lifetime or SHA-256 package binding. An attacker with a compromised dashboard administrator credential or API key with plugin-install permission who finds a stale allowed name and version can upload attacker-controlled bytes under the allowed .tar.gz filename through POST /api/v5/plugins/install or the dashboard plugin upload. The broker then installs and runs attacker-controlled Erlang code with the privileges of the EMQX process. This issue is fixed in versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
emqx
- Vendor
- emqx
- Product
- emqx
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| < 5.8.11 | affected | Unavailable | Unavailable | Unavailable | None listed |
| >= 5.9.0, < 5.9.3 | affected | Unavailable | Unavailable | Unavailable | None listed |
| >= 5.10.0, < 5.10.4 | affected | Unavailable | Unavailable | Unavailable | None listed |
| >= 6.0.0, < 6.0.3 | affected | Unavailable | Unavailable | Unavailable | None listed |
| >= 6.1.0, < 6.1.2 | affected | Unavailable | Unavailable | Unavailable | None listed |
| >= 6.2.0, < 6.2.1 | affected | Unavailable | Unavailable | Unavailable | None listed |