Description

EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute grant lifetime or SHA-256 package binding. An attacker with a compromised dashboard administrator credential or API key with plugin-install permission who finds a stale allowed name and version can upload attacker-controlled bytes under the allowed .tar.gz filename through POST /api/v5/plugins/install or the dashboard plugin upload. The broker then installs and runs attacker-controlled Erlang code with the privileges of the EMQX process. This issue is fixed in versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-08-20T15:17:30.003Z",
  "pubdate": "2026-08-20T15:17:30.003Z",
  "executiveSummary": "An improper authorization and inadequate cryptographic binding vulnerability exists within the plugin-install REST API and dashboard upload mechanisms of the EMQX MQTT broker. The flaw allows authenticated actors possessing compromised dashboard administrator credentials or API keys with plugin-install permissions to leverage stale grants created via emqx ctl plugins allow. Due to the absence of a five-minute grant lifetime enforcement and SHA-256 package binding, an attacker can substitute attacker-controlled bytes under an allowed .tar.gz filename. Successful exploitation enables the execution of arbitrary, attacker-controlled Erlang code running with the elevated privileges of the underlying EMQX process, leading to complete system compromise. The vulnerability affects EMQX prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1.",
  "technicalDetails": "The vulnerability resides in the plugin installation functionality exposed via the REST API endpoint POST /api/v5/plugins/install and the administrative dashboard plugin upload feature within EMQX. The root cause stems from insufficient validation checks and state management concerning plugin installation authorizations generated via the administrative command-line interface command emqx ctl plugins allow. Historically, these grants lacked strict cryptographic integrity checks, specifically SHA-256 package binding, and failed to enforce a mandatory five-minute grant expiration lifetime.\nAttackers targeting this vulnerability must first acquire valid dashboard administrator credentials or an API key possessing specific plugin-install permissions. Upon authentication, the attacker identifies a stale or previously authorized plugin name and version that remains accepted by the broker's insecure authorization logic. Instead of uploading the legitimate package corresponding to the stale grant, the attacker crafts a malicious archive containing arbitrary Erlang code disguised under the permitted .tar.gz filename.\nThe attack flow proceeds as follows: 1) The attacker authenticates to the management interface or REST API using compromised administrative credentials. 2) The attacker submits a malicious .tar.gz payload to POST /api/v5/plugins/install or the dashboard upload interface, matching a stale allowed plugin grant. 3) The EMQX broker processes the upload, bypassing strict temporal and cryptographic verification. 4) The broker extracts and installs the attacker-controlled Erlang package. 5) The embedded malicious code executes within the context of the Erlang virtual machine running the EMQX service.\nThe vulnerable components involve the authorization validation routines handling plugin uploads and administrative grants. Affected versions include all EMQX deployments prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1. The attack vector requires network exposure to the EMQX management dashboard or REST API, valid administrative authentication credentials, and specific plugin-install privileges. Post-exploitation impact results in remote code execution, granting the adversary full control over the EMQX process and potential lateral movement within the underlying host environment."
}