Is there a public PoC exploit available for CVE-2026-8741?

Yes, a public proof-of-concept exploit is available for CVE-2026-8741. Prioritise patching immediately. EPSS: 0.0%.

EMQX CVE-2026-8741

Q: What is the CVSS score of CVE-2026-8741?

CVE-2026-8741 has a CVSS 4.0 base score of 1.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30692 LOW

Race Condition (CWE-362)

2026-05-17 VulDB

GHSA-48p2-hcwr-rx4q

Information Disclosure Race Condition N A Emqx

1.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.3 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

May 17, 2026 - 09:22 NVD

3.1 (LOW) 1.3 (LOW)

Analysis Generated

May 17, 2026 - 09:15 vuln.today

DescriptionCVE.org

A vulnerability has been found in EMQX up to 6.2.0. This affects an unknown function of the file apps/emqx/src/emqx_persistent_session_ds.erl of the component QoS 2 PUBLISH Packet Handler. Such manipulation leads to race condition. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

AnalysisAI

Race condition in EMQX MQTT broker versions up to 6.2.0 allows authenticated remote attackers to cause limited availability impact through malformed QoS 2 PUBLISH packet handling in persistent sessions. The vulnerability exploits timing windows in the emqx_persistent_session_ds.erl module, though successful exploitation is marked as difficult with high attack complexity. A proof-of-concept exploit is publicly available on GitHub (Pathfind-tama/Report_EMQX_MQTT), demonstrating QoS 2 message duplication attacks. CVSS 3.1, exploitability requires low-privilege authentication and precise timing, limiting real-world risk despite public POC.

Technical ContextAI

EMQX is an open-source MQTT broker written in Erlang/OTP, commonly deployed for IoT message routing and pub-sub architectures. This vulnerability affects the persistent session storage module (emqx_persistent_session_ds.erl) which manages durable MQTT connections and message delivery guarantees. The root cause is CWE-362 (concurrent execution using shared resource with improper synchronization), occurring during QoS 2 (exactly-once delivery) message acknowledgment flows. QoS 2 uses a four-step handshake (PUBLISH → PUBREC → PUBREL → PUBCOMP), and the race condition exploits timing windows in state transitions within persistent session data structures. Erlang's lightweight process model may create scenarios where concurrent message handlers access shared session state without proper locking, leading to inconsistent delivery tracking or resource exhaustion.

RemediationAI

Primary mitigation is upgrading to EMQX version newer than 6.2.0 if a patched release exists - consult EMQ Technologies security advisories at emqx.io/security or GitHub releases github.com/emqx/emqx/releases for confirmed fix version, as vendor patch status is not independently verified in provided data. If immediate patching is not feasible, implement these compensating controls: (1) Restrict MQTT client authentication to trusted entities only, removing shared credentials or open registration that could allow malicious authenticated access (PR:L requirement means auth is mandatory for exploitation). (2) Disable persistent sessions (clean_session=true / Clean Start=1) for non-critical clients to bypass the vulnerable emqx_persistent_session_ds.erl code path, though this sacrifices message durability guarantees. (3) Rate-limit QoS 2 PUBLISH messages per client using EMQX's built-in quota management to reduce race condition trigger opportunities, accepting potential degradation of legitimate high-throughput QoS 2 flows. (4) Monitor broker resource utilization and session state anomalies to detect exploitation attempts. Reference the detailed POC at github.com/Pathfind-tama/Report_EMQX_MQTT for attack signatures to inform detection rules.