CVE-2026-44725— EMQX 过期插件致使管理员/API密钥权限滥用可致远程代码执行漏洞
获取后续新漏洞提醒登录后订阅
一、 漏洞 CVE-2026-44725 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗ 尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution
来源: CVE Program / CVE List V5
Vulnerability Description
EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute grant lifetime or SHA-256 package binding. An attacker with a compromised dashboard administrator credential or API key with plugin-install permission who finds a stale allowed name and version can upload attacker-controlled bytes under the allowed .tar.gz filename through POST /api/v5/plugins/install or the dashboard plugin upload. The broker then installs and runs attacker-controlled Erlang code with the privileges of the EMQX process. This issue is fixed in versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-44725 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-44725 的情报信息
请登录查看更多情报信息。
CVE-2026-44725 补丁与修复 (4)
CVE-2026-44725 厂商安全公告 (1)
CVE-2026-44725 厂商页面 (4)
- 🔗 Release EMQX Enterprise 6.1.2 · emqx/emqx · GitHubx_refsource_MISC
IV. Related Vulnerabilities
Same product: emqx
V. Comments for CVE-2026-44725
暂无评论