Log in Start free

Vulnerability · Published Aug 20, 2026 · Assigned by GitHub_M

CVE-2026-44725EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution

Medium 6.6

In plain English

A medium-severity insufficient verification of data authenticity in emqx from emqx. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)6.6Medium
Exploit odds (30 days)0.4%top 68.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute grant lifetime or SHA-256 package binding. An attacker with a compromised dashboard administrator credential or API key with plugin-install permission who finds a stale allowed name and version can upload attacker-controlled bytes under the allowed .tar.gz filename through POST /api/v5/plugins/install or the dashboard plugin upload. The broker then installs and runs attacker-controlled Erlang code with the privileges of the EMQX process. This issue is fixed in versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1.

Affected products (as reported)

VendorProductVersions
emqx emqx < 5.8.11>= 5.9.0, < 5.9.3>= 5.10.0, < 5.10.4>= 6.0.0, < 6.0.3>= 6.1.0, < 6.1.2>= 6.2.0, < 6.2.1

Weakness: CWE-345, CWE-672 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

References