CVE-2026-71235
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side. The Lua engine performs no input validation and preloads dangerous libraries enabling arbitrary code execution, DB access, file I/O, SSRF, and path traversal.
Risk Assessment
An attacker can execute arbitrary code on the server, access the database, read files, or perform SSRF attacks, potentially leading to full system compromise.
Recommendation
Restrict rule creation access, implement script validation, and remove dangerous libraries from the Lua runtime environment.
Other vulnerabilities in Magistrala
See all- CVE-2026-111684High
Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view, issue, and revoke other tenants' device certificates by supplying foreign serials or entity ids. Attackers can call RevokeBySerial, RevokeAll, ViewCert, ListCerts, or IssueCert under their own workspace path to disconnect other tenants' devices, disclose certificates, and mint CA-signed certificates for their device ids.
- CVE-2026-82028High
Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services, allowing authenticated attackers to inject arbitrary SQL via the format parameter.
- CVE-2026-71276High
Magistrala (formerly Mainflux)'s message-readers API reads a value from the HTTP query string (readers/api/http/transport.go) with no validation and interpolates it directly into raw SQL queries via fmt.Sprintf in both the PostgreSQL reader (readers/postgres/messages.go: ) and the TimescaleDB reader (readers/timescale/messages.go, same pattern), enabling SQL injection by any authenticated user able to query channel messages.
Original NVD description (English source)
Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua script engine (re/lua.go) performs no input validation at all and preloads dangerous libraries: db (arbitrary database access), ioutil (file I/O), an HTTP client (SSRF), and filepath (traversal).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS