CVE-2026-44725
Received Received - Intake

Privilege Escalation in EMQX MQTT Broker via Stale Plugin Grants

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute grant lifetime or SHA-256 package binding. An attacker with a compromised dashboard administrator credential or API key with plugin-install permission who finds a stale allowed name and version can upload attacker-controlled bytes under the allowed .tar.gz filename through POST /api/v5/plugins/install or the dashboard plugin upload. The broker then installs and runs attacker-controlled Erlang code with the privileges of the EMQX process. This issue is fixed in versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-44725
EUVD
EUVD-2026-63381

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
emqx emqx to 5.8.11 (inc)
emqx emqx to 5.9.3 (inc)
emqx emqx to 5.10.4 (inc)
emqx emqx to 6.0.3 (inc)
emqx emqx to 6.1.2 (inc)
emqx emqx to 6.2.1 (inc)
emqx emqx to 6.2.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-672 The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the EMQX MQTT broker's plugin installation system. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, plugin installation allowlist entries had no expiration time and lacked package integrity checks. An attacker with compromised admin credentials or API key could exploit stale allowlist entries to upload malicious plugins, bypassing security controls and executing arbitrary code with EMQX process privileges.

Detection Guidance

Check EMQX versions against patched releases (5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, 6.2.1). Review plugin installation logs for unauthorized uploads or installations. Monitor for unexpected plugin activity or file writes outside plugin directories.

Impact Analysis

If exploited, this vulnerability allows remote code execution within the EMQX broker. Attackers could gain full control over the MQTT broker, intercept or manipulate MQTT traffic, access sensitive data, or use the broker as a foothold to compromise connected IoT or IIoT devices. The impact depends on the broker's deployment environment and the privileges of the EMQX process.

Compliance Impact

This vulnerability primarily affects access control and integrity of the EMQX system, which could indirectly impact compliance with standards like GDPR or HIPAA by enabling unauthorized code execution. If exploited, it may lead to data breaches or unauthorized access to sensitive data processed by the MQTT broker, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Upgrade EMQX to the latest patched versions immediately. Rotate all dashboard administrator credentials and API keys with plugin-install permissions. Review and revoke any stale plugin allowlist entries. Restrict network access to plugin installation endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44725. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart