CVE-2026-44725: EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution
EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute grant lifetime or SHA-256 package binding. An attacker with a compromised dashboard administrator credential or API key with plugin-install permission who finds a stale allowed name and version can upload attacker-controlled bytes under the allowed .tar.gz filename through POST /api/v5/plugins/install or the dashboard plugin upload. The broker then installs and runs attacker-controlled Erlang code with the privileges of the EMQX process. This issue is fixed in versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
EMQX MQTT broker (plugin-install REST API and dashboard plugin upload)to a version that resolves this vulnerability.Fixed in 5.8.11 - Upgrade
Upgrade
EMQX MQTT broker (plugin-install REST API and dashboard plugin upload)to a version that resolves this vulnerability.Fixed in 5.9.3 - Upgrade
Upgrade
EMQX MQTT broker (plugin-install REST API and dashboard plugin upload)to a version that resolves this vulnerability.Fixed in 5.10.4 - Upgrade
Upgrade
EMQX MQTT broker (plugin-install REST API and dashboard plugin upload)to a version that resolves this vulnerability.Fixed in 6.0.3 - Upgrade
Upgrade
EMQX MQTT broker (plugin-install REST API and dashboard plugin upload)to a version that resolves this vulnerability.Fixed in 6.1.2 - Upgrade
Upgrade
EMQX MQTT broker (plugin-install REST API and dashboard plugin upload)to a version that resolves this vulnerability.Fixed in 6.2.1
Event History
Frequently Asked Questions
Who is exposed to exploitation?
EMQX deployments before 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, or 6.2.1 are exposed if they have a stale plugin allow grant created with emqx ctl plugins allow and an attacker obtains a dashboard administrator credential or an API key with plugin-install permission.
What does an attacker need to exploit this issue?
The attacker needs a compromised dashboard administrator credential or an API key authorized for plugin installation, plus knowledge of a stale allowed plugin name and version. They can then upload malicious content using the permitted .tar.gz filename through the REST API or dashboard upload.
What is the impact after successful exploitation?
The broker installs and runs attacker-controlled Erlang code with the privileges of the EMQX process. This can affect confidentiality, integrity, and availability of the affected broker environment.
How can the risk be reduced if upgrading is not immediately possible?
The provided data identifies stale grants created with emqx ctl plugins allow as a prerequisite. Restrict access to dashboard administrator credentials and API keys with plugin-install permission, and review whether stale allowed plugin names and versions remain available.
How can an organization determine whether it is affected?
Check whether the EMQX version is earlier than the fixed release for its branch: 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, or 6.2.1. Also determine whether emqx ctl plugins allow has created stale plugin allow grants and whether plugin installation is accessible through the REST API or dashboard.