What is the CVSS score of CVE-2026-71235?

CVE-2026-71235 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Magistrala Rules Engine are affected by CVE-2026-71235?

Magistrala Rules Engine contains an arbitrary code execution vulnerability allowing any authenticated user with rule-creation privileges to achieve full file system access, credential exfiltration,…

How to fix or mitigate CVE-2026-71235?

Within 24 hours: audit and document all users with rule creation permissions across all Magistrala deployments; enable comprehensive logging for rule creation, modification, and execution activities; review Magistrala security advisories for any available guidance. Within 7 days: disable both Yaegi (Go) and Lua script engines in Magistrala Rules Engine configuration; implement strict role-based access controls restricting rule creation to pre-approved security-reviewed users only; audit all existing rules for suspicious file system, environment variable, database, or HTTP client operations. Within 30 days: monitor Magistrala vendor channels for patched versions of CVE-2026-71235; evaluate and plan migration to alternative rules engine with proper sandboxing; conduct forensic analysis of rule execution logs for indicators of unauthorized data access or infrastructure compromise.

Magistrala Rules Engine CVE-2026-71235

EUVD-2026-53308 HIGH

Code Injection (CWE-94)

2026-08-05 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

GHSA-vq5v-m87m-6pqm

RCE SSRF Code Injection

8.8

CVSS 3.1 · Vendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Severity by source

Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

S:C assigned because SSRF and arbitrary DB access impact systems beyond the vulnerable Rules Engine component; all other metrics match the vendor vector.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c).

CVSS VectorVendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 11:36 vuln.today

CVE Published

Aug 05, 2026 - 11:16 cve.org

HIGH 8.8

DescriptionCVE.org

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Go script engine (re/golang.go) runs scripts through the Yaegi interpreter with stdlib.Symbols, exposing the full Go standard library (including os and net/http) with validation limited to a regex blocking goroutines and panic() calls; dangerous functions such as os.ReadFile, os.WriteFile, os.Remove, and os.Environ remain fully accessible. The Lua script engine (re/lua.go) performs no input validation at all and preloads dangerous libraries: db (arbitrary database access), ioutil (file I/O), an HTTP client (SSRF), and filepath (traversal). An authenticated low-privileged user can achieve arbitrary file read/write, environment variable leakage, database access, and SSRF against internal microservices.

AnalysisAI

Arbitrary server-side code execution in Magistrala's Rules Engine exposes any authenticated low-privileged user to full file system access, environment variable exfiltration, database manipulation, and SSRF against internal microservices. The platform's two script runtimes - Go via Yaegi and Lua - both fail to sandbox dangerous capabilities: the Go engine exposes the complete standard library behind a trivially insufficient regex filter, while the Lua engine performs no validation whatsoever and explicitly preloads file I/O, HTTP client, and database libraries. No public exploit code has been identified at time of analysis, but the attack requires only a valid account and the ability to create rules, making exploitation straightforward for any tenant or internal user.

Technical ContextAI

Magistrala (github.com/absmach/magistrala) is an open-source IoT platform whose Rules Engine allows users to author event-driven scripts triggered by incoming IoT messages. Two script runtimes are affected. The Go runtime (re/golang.go) uses the Yaegi interpreter initialized with stdlib.Symbols, which grants scripts access to the entire Go standard library - including os, net/http, and os/exec - and only attempts to block goroutine creation and panic() via a regex check, which provides no meaningful security boundary. The Lua runtime (re/lua.go) performs zero input validation and preloads db (arbitrary DBMS access), ioutil (file I/O), an HTTP client library (enabling SSRF), and filepath (enabling path traversal). The root cause is CWE-94 (Improper Control of Generation of Code): user-supplied scripts reach a powerful interpreter without adequate capability restriction or sandboxing, violating the principle of least privilege at the runtime level.

RemediationAI

No vendor-released patched version has been identified at time of analysis. The upstream fix has not been confirmed via a tagged release or security advisory - only the GitHub repository root was referenced, with no linked PR, commit, or release. As an immediate compensating control, operators should disable or restrict access to the Rules Engine feature entirely for untrusted or low-privileged users, accepting the trade-off of reduced automation capability. For the Go engine, the Yaegi interpreter should be initialized without stdlib.Symbols and instead with an explicit allowlist of safe packages only - removing this requires code changes. For the Lua engine, dangerous preloaded libraries (db, ioutil, HTTP client, filepath) must be removed from the sandbox initialization in re/lua.go; this also requires a code change. Where disabling the feature is not feasible, restrict rule creation to administrator-level accounts only via RBAC policy, and network-segment the Magistrala host to block outbound HTTP from the process to internal subnets, mitigating the SSRF vector. Monitor the upstream repository at https://github.com/absmach/magistrala for a patch release.