CVE-2026-44725

CVE-2026-44725 is a grant-staging vulnerability in EMQX's plugin-allow mechanism. An operator with valid credentials can create a plugin-install grant with an allowed filename, enumerate that grant, and upload a malicious .tar.gz payload under the permitted name — without the package actually matching what the grant was intended to authorize. The root cause: the grant system shipped with binding constraints (five-minute lifetime, SHA-256 package hash verification) that were either never implemented or subsequently removed from the codebase. The five-minute lifetime fix addresses the stale-grant enumeration path, but recognize what it does and doesn't protect. If an attacker has real-time credential access, the five-minute window creates zero meaningful friction — authenticating, enumerating allowed names, crafting a payload, and uploading takes well under five minutes for a motivated actor. The fix primarily reduces risk from credential leaks where attackers are scanning for old grants, not from active credential compromise. More importantly, the permission model itself remains underspecified. Plugin-install permission isn't a constrained administrative action — it's the ability to execute arbitrary Erlang code on a broker that handles connected vehicles, industrial IoT, and AI inference workloads. Once code execution occurs, blast radius is already maximal. Every telemetry stream, vehicle command, and inference input flowing through that broker is now attacker-controlled. This isn't a plugin management bug; it's an infrastructure compromise vector. Check your plugin lifecycle surface beyond install. Plugin-update, plugin-configure, and plugin-uninstall likely share the same underspecified authorization model. If the allow mechanism was the only control constraining those operations, an attacker with valid credentials can achieve the same outcome without exploiting grant staleness at all. Your remediation should treat this as a critical infrastructure compromise scenario — validate that plugin-install permissions are tightly scoped, consider single-request token semantics rather than sliding windows for any future grants, and audit whether plugin-update and plugin-configure operations require similar binding constraints.

Reviewed through automated stages and approved by a human before publication.