Executive brief
EMQX is a message broker used to connect IoT devices and handle real-time data streams. The plugin installation API accepted stale authorization grants without expiration or integrity checks, allowing an attacker with a compromised admin account to upload and execute arbitrary code with the broker's privileges, potentially compromising all connected devices and disrupting operations.
Technical details
The vulnerability is an insufficient access control flaw in the plugin-install REST API and dashboard upload functionality. The issue stems from missing time-to-live (TTL) validation on plugin installation grants issued via `emqx ctl plugins allow` and the absence of SHA-256 package binding. An attacker with compromised dashboard administrator credentials or an API key holding plugin-install permission can reuse expired grants to upload arbitrary .tar.gz files via POST /api/v5/plugins/install, which are then extracted and executed as Erlang code with the EMQX process privileges. The fix introduces 5-minute grant expiration and optional SHA-256 digest pinning (proto v4), while maintaining backward compatibility with v3 for rolling upgrades.
Affected products
- EMQ EMQX before 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1
Timeline
- 2026-08-20: disclosed
- 2026-05-02: patched: Fix committed; versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1 available