CVE-2026-71235
Received Received - Intake

Arbitrary File Read/Write in Magistrala Rules Engine

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Go script engine (re/golang.go) runs scripts through the Yaegi interpreter with stdlib.Symbols, exposing the full Go standard library (including os and net/http) with validation limited to a regex blocking goroutines and panic() calls; dangerous functions such as os.ReadFile, os.WriteFile, os.Remove, and os.Environ remain fully accessible. The Lua script engine (re/lua.go) performs no input validation at all and preloads dangerous libraries: db (arbitrary database access), ioutil (file I/O), an HTTP client (SSRF), and filepath (traversal). An authenticated low-privileged user can achieve arbitrary file read/write, environment variable leakage, database access, and SSRF against internal microservices.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71235
EUVD
EUVD-2026-53308

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
absmach magistrala *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts that execute server-side when IoT messages arrive. The Go script engine uses the Yaegi interpreter with limited validation, exposing dangerous functions like file I/O and environment variables. The Lua script engine performs no input validation and preloads libraries enabling file operations, database access, HTTP requests, and path traversal.

Detection Guidance

Check for unauthorized file access or modification in logs, monitor network traffic for SSRF attempts, and inspect Lua/Go scripts executed by the Rules Engine. Look for unexpected database queries or environment variable leaks.

Impact Analysis

An authenticated low-privileged user could read or write arbitrary files, leak environment variables, access databases, or perform server-side request forgery against internal services. This could lead to data breaches, unauthorized modifications, or lateral movement within the system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. It may result in non-compliance due to potential data breaches, lack of access controls, and insufficient input validation.

Mitigation Strategies

Disable embedded scripting in the Rules Engine, restrict user permissions to least privilege, implement strict input validation for scripts, and monitor for suspicious activity. Update to a patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71235. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart