{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "5.8.11"
              },
              {
                "introduced": "5.9.0"
              },
              {
                "fixed": "5.9.3"
              },
              {
                "introduced": "5.10.0"
              },
              {
                "fixed": "5.10.4"
              },
              {
                "introduced": "6.0.0"
              },
              {
                "fixed": "6.0.3"
              },
              {
                "introduced": "6.1.0"
              },
              {
                "fixed": "6.1.2"
              },
              {
                "introduced": "6.2.0"
              },
              {
                "fixed": "6.2.1"
              }
            ],
            "source": [
              "AFFECTED_FIELD",
              "REFERENCES"
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "introduced": "b2443ba3d1782a32e018f717311c5c49de687ed3"
            },
            {
              "introduced": "b3cbc08540e2af324ec8ee49ee0813494365b9f3"
            },
            {
              "introduced": "b15e6dc7193207a0709f0caa79f9c69cbadbbe8c"
            },
            {
              "introduced": "7ed38516e9acc30de06fa32b8d2e659520d7d85c"
            },
            {
              "introduced": "5f205e1b301d7aee80e72c1c4d44e71f2a4793d6"
            },
            {
              "fixed": "bb073703d48fc0e5694256e13e2e2fe8535fba51"
            },
            {
              "fixed": "5d155d516ca7cb462d47c22feb7961135ad1eea5"
            },
            {
              "fixed": "416bc5cf62ff72845baec5ca095f8c472cbd712d"
            },
            {
              "fixed": "073b31b88e65dcf4a7f461e0374fa1689a055ca7"
            },
            {
              "fixed": "5b29a7101af9269d13fea6bfbf31b8b53dc1feab"
            },
            {
              "fixed": "65cbf01efa5224119f8bd1f801e43664481ccc97"
            },
            {
              "fixed": "2f926359fa847dd9928a8e94d3e342f5621806f4"
            },
            {
              "fixed": "efa1ca1bef1517f1f87e1d562f8db8750b6d6ce3"
            }
          ],
          "repo": "https://github.com/emqx/emqx",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-cp9x-5qwc-fj6r"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-345",
      "CWE-672"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44725.json"
  },
  "details": "EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute grant lifetime or SHA-256 package binding. An attacker with a compromised dashboard administrator credential or API key with plugin-install permission who finds a stale allowed name and version can upload attacker-controlled bytes under the allowed .tar.gz filename through POST /api/v5/plugins/install or the dashboard plugin upload. The broker then installs and runs attacker-controlled Erlang code with the privileges of the EMQX process. This issue is fixed in versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1.",
  "id": "CVE-2026-44725",
  "modified": "2026-08-23T03:42:43.585965619Z",
  "published": "2026-08-20T14:35:11.726Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/emqx/emqx/releases/tag/6.0.3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/emqx/emqx/releases/tag/6.1.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/emqx/emqx/releases/tag/6.2.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/emqx/emqx/releases/tag/e5.10.4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/emqx/emqx/releases/tag/e5.8.11"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44725.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/emqx/emqx/security/advisories/GHSA-cp9x-5qwc-fj6r"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44725"
    },
    {
      "type": "FIX",
      "url": "https://github.com/emqx/emqx/commit/2f926359fa847dd9928a8e94d3e342f5621806f4"
    },
    {
      "type": "FIX",
      "url": "https://github.com/emqx/emqx/commit/efa1ca1bef1517f1f87e1d562f8db8750b6d6ce3"
    },
    {
      "type": "FIX",
      "url": "https://github.com/emqx/emqx/pull/17200"
    },
    {
      "type": "FIX",
      "url": "https://github.com/emqx/emqx/pull/17201"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution"
}