EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-345.
Summary
EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute grant lifetime or SHA-256 package binding. An attacker with a compromised dashboard administrator credential or API key with plugin-install permission who finds a stale allowed name and version can upload attacker-controlled bytes under the allowed .tar.gz filename through POST /api/v5/plugins/install or the dashboard plugin upload. The broker then installs and runs attacker-controlled Erlang code with the privileges of the EMQX process. This issue is fixed in versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nanomq | emqx | before 5.8.11; 5.9.0 to before 5.9.3; 5.10.0 to before 5.10.4; 6.0.0 to before 6.0.3; 6.1.0 to before 6.1.2; 6.2.0 to before 6.2.1 | 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, 6.2.1 | Patch available | CNA |
- emqx Vendornanomq Affected before 5.8.11; 5.9.0 to before 5.9.3; 5.10.0 to before 5.10.4; 6.0.0 to before 6.0.3; 6.1.0 to before 6.1.2; 6.2.0 to before 6.2.1 Fixed in 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, 6.2.1 Patch available CNA
Remediation
- Fix · CNA emqx (emqx) Fixed in 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, 6.2.1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-44725
References
Other 10
- https://github.com/emqx/emqx/security/advisories/GHSA-cp9x-5qwc-fj6r
- https://github.com/emqx/emqx/pull/17200
- https://github.com/emqx/emqx/pull/17201
- https://github.com/emqx/emqx/commit/2f926359fa847dd9928a8e94d3e342f5621806f4
- https://github.com/emqx/emqx/commit/efa1ca1bef1517f1f87e1d562f8db8750b6d6ce3
- https://github.com/emqx/emqx/releases/tag/6.0.3
- https://github.com/emqx/emqx/releases/tag/6.1.2
- https://github.com/emqx/emqx/releases/tag/6.2.1
- https://github.com/emqx/emqx/releases/tag/e5.10.4
- https://github.com/emqx/emqx/releases/tag/e5.8.11
More nanomq vulnerabilities
- TI-2026-24672 NanoMQ has Heap Buffer Overflow in URI Parameter Parsing CVSS 4.0HIGH 7.7
- TI-2024-28570 An access control issue in NanoMQ v0.21.10 allows attackers to bypass security… CVSS 3.1HIGH 8.8
- TI-2026-27853 An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via… CVSS 3.1HIGH 7.5
- TI-2026-17589 MQTT v5 Variable Byte Integer parsing out-of-bounds: get_var_integer() CVSS 3.1HIGH 7.5
- TI-2024-20452 Null Pointer Dereference vulnerability in topic_filtern function in mqtt_parser.c in… CVSS 3.1HIGH 7.5
- TI-2023-17307 NanoMQ 0.16.5 is vulnerable to heap-use-after-free in the nano_ctx_send function of nmq_mqtt.c. CVSS 3.1HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences