Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua script engine (re/lua.go) performs no input validation at all and preloads dangerous libraries: db (arbitrary database access), ioutil (file I/O), an HTTP client (SSRF), and filepath (traversal).

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00288.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Absmach Subscribe
Magistrala Subscribe

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Absmach Subscribe
Magistrala Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/absmach/magistrala cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-71235 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-71235 cve-icon
History

Mon, 10 Aug 2026 12:00:00 +0000

Type Values Removed Values Added
Description Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Go script engine (re/golang.go) runs scripts through the Yaegi interpreter with stdlib.Symbols, exposing the full Go standard library (including os and net/http) with validation limited to a regex blocking goroutines and panic() calls; dangerous functions such as os.ReadFile, os.WriteFile, os.Remove, and os.Environ remain fully accessible. The Lua script engine (re/lua.go) performs no input validation at all and preloads dangerous libraries: db (arbitrary database access), ioutil (file I/O), an HTTP client (SSRF), and filepath (traversal). An authenticated low-privileged user can achieve arbitrary file read/write, environment variable leakage, database access, and SSRF against internal microservices. Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua script engine (re/lua.go) performs no input validation at all and preloads dangerous libraries: db (arbitrary database access), ioutil (file I/O), an HTTP client (SSRF), and filepath (traversal).

Mon, 10 Aug 2026 11:30:00 +0000

Type Values Removed Values Added
Title Magistrala IoT Platform: Unrestricted Go/Lua Script Execution in Rules Engine Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine

Fri, 07 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Absmach
Absmach magistrala
Vendors & Products Absmach
Absmach magistrala

Thu, 06 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 05 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 05 Aug 2026 13:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Wed, 05 Aug 2026 11:15:00 +0000

Type Values Removed Values Added
Description Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Go script engine (re/golang.go) runs scripts through the Yaegi interpreter with stdlib.Symbols, exposing the full Go standard library (including os and net/http) with validation limited to a regex blocking goroutines and panic() calls; dangerous functions such as os.ReadFile, os.WriteFile, os.Remove, and os.Environ remain fully accessible. The Lua script engine (re/lua.go) performs no input validation at all and preloads dangerous libraries: db (arbitrary database access), ioutil (file I/O), an HTTP client (SSRF), and filepath (traversal). An authenticated low-privileged user can achieve arbitrary file read/write, environment variable leakage, database access, and SSRF against internal microservices.
Title Magistrala IoT Platform: Unrestricted Go/Lua Script Execution in Rules Engine
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: TuranSec

Published:

Updated: 2026-08-10T11:45:36.029Z

Reserved: 2026-08-05T10:53:53.175Z

Link: CVE-2026-71235

cve-icon Vulnrichment

Updated: 2026-08-05T12:52:39.119Z

cve-icon NVD

Status : Received

Published: 2026-08-05T11:16:26.247

Modified: 2026-08-10T12:17:25.983

Link: CVE-2026-71235

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-05T10:56:25Z

Links: CVE-2026-71235 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-10T22:00:05Z

Weaknesses