CVE-2026-44725

EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution

MEDIUM

6.6

CVSS Score

Published: August 20, 2026 at 02:35 PM UTC

Updated: October 26, 2026 at 10:10 AM UTC

1 product affected across 1 vendorEmqx

Using emqx by emqx?

Get instant alerts when new vulnerabilities affect emqx - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.6

Exploit prediction

EPSS 0.4%

SSVC

No known exploit

Description

EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute grant lifetime or SHA-256 package binding. An attacker with a compromised dashboard administrator credential or API key with plugin-install permission who finds a stale allowed name and version can upload attacker-controlled bytes under the allowed .tar.gz filename through POST /api/v5/plugins/install or the dashboard plugin upload. The broker then installs and runs attacker-controlled Erlang code with the privileges of the EMQX process. This issue is fixed in versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Emqx · Emqx

90%

v < 5.8.11>= 5.10.0, < 5.10.4 >= 5.9.0, < 5.9.3 >= 6.0.0, < 6.0.3 >= 6.1.0, < 6.1.2 >= 6.2.0, < 6.2.1

Affected range stops below 5.10.4, so it looks safe — our inference, not a vendor statement

Affected range stops below 5.8.11, so it looks safe — our inference, not a vendor statement

Affected range stops below 5.9.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.0.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.1.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.2.1, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (10)

x_refsource_CONFIRM

Source: cverecord

https://github.com/emqx/emqx/security/advisories/GHSA-cp9x-5qwc-fj6r

x_refsource_MISC

Source: cverecord

https://github.com/emqx/emqx/pull/17200

x_refsource_MISC

Source: cverecord

https://github.com/emqx/emqx/pull/17201

x_refsource_MISC

Source: cverecord

https://github.com/emqx/emqx/commit/2f926359fa847dd9928a8e94d3e342f5621806f4

x_refsource_MISC

Source: cverecord

https://github.com/emqx/emqx/commit/efa1ca1bef1517f1f87e1d562f8db8750b6d6ce3

x_refsource_MISC

Source: cverecord

https://github.com/emqx/emqx/releases/tag/6.0.3

x_refsource_MISC

Source: cverecord

https://github.com/emqx/emqx/releases/tag/6.1.2

x_refsource_MISC

Source: cverecord

https://github.com/emqx/emqx/releases/tag/6.2.1

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.6MEDIUMGitHub_M

Attack Vector: NETWORK
Complexity: HIGH
Privileges: HIGH
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusDEFERRED

CWE

CWE-345CWE-672

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card