Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2026-71235: Magistrala IoT Platform: Unrestricted Code Execution in Rules Engine
CVE-2026-71235
CVE-2026-71235
Summary
An attacker with a Magistrala account can run malicious code to access and modify sensitive data, potentially leading to data breaches or disruptions. This is a concern because Magistrala is used to manage IoT devices, which can be critical to business operations. To protect against this vulnerability, ensure that users only have the necessary permissions and monitor the Rules Engine closely for any suspicious activity.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| absmach | magistrala | All versions |
Original title
Magistrala IoT Platform: Unrestricted Go/Lua Script Execution in Rules Engine
Original description
Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Go script engine (re/golang.go) runs scripts through the Yaegi interpreter with stdlib.Symbols, exposing the full Go standard library (including os and net/http) with validation limited to a regex blocking goroutines and panic() calls; dangerous functions such as os.ReadFile, os.WriteFile, os.Remove, and os.Environ remain fully accessible. The Lua script engine (re/lua.go) performs no input validation at all and preloads dangerous libraries: db (arbitrary database access), ioutil (file I/O), an HTTP client (SSRF), and filepath (traversal). An authenticated low-privileged user can achieve arbitrary file read/write, environment variable leakage, database access, and SSRF against internal microservices.
nvd CVSS3.1
8.8
Vulnerability type
CWE-94
Code Injection
Published: 5 Aug 2026 · Updated: 5 Aug 2026 · First seen: 5 Aug 2026