Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-05T10:56:25 github.com/absmach/magistrala: Magistrala IoT Platform: Arbitrary Code Execution via Unrestricted Script Execution 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-94

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Go script engine (re/golang.go) runs scripts through the Yaegi interpreter with stdlib.Symbols, exposing the full Go standard library (including os and net/http) with validation limited to a regex blocking goroutines and panic() calls; dangerous functions such as os.ReadFile, os.WriteFile, os.Remove, and os.Environ remain fully accessible. The Lua script engine (re/lua.go) performs no input validation at all and preloads dangerous libraries: db (arbitrary database access), ioutil (file I/O), an HTTP client (SSRF), and filepath (traversal). An authenticated low-privileged user can achieve arbitrary file read/write, environment variable leakage, database access, and SSRF against internal microservices.

A flaw was found in Magistrala's Rules Engine. An authenticated low-privileged user can exploit this vulnerability by creating rules with embedded Go or Lua scripts. These scripts are executed server-side without sufficient validation, allowing for arbitrary file read and write operations, access to internal databases, and Server-Side Request Forgery (SSRF) against internal microservices. This could lead to significant data compromise and unauthorized system access.

Assisted Installer for Red Hat OpenShift Container Platform 2 Affected rhai/assisted-installer-rhel9 Builds for Red Hat OpenShift Not affected openshift-builds/openshift-builds-waiters-rhel9 cert-manager Operator for Red Hat OpenShift Affected cert-manager/jetstack-cert-manager-rhel9 Compliance Operator Not affected compliance/openshift-compliance-operator-bundle Confidential Compute Attestation Affected build-of-trustee/trustee-rhel9-operator Cryostat 4 Affected cryostat/cryostat-storage-rhel9 Custom Metric Autoscaler operator for Red Hat Openshift Not affected custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9 Deployment Validation Operator Affected dvo/deployment-validation-rhel8-operator External Secrets Operator for Red Hat OpenShift Not affected external-secrets-operator/external-secrets-rhel9 Fence Agents Remediation Operator Affected workload-availability/fence-agents-remediation-rhel8-operator File Integrity Operator Not affected compliance/openshift-compliance-operator-bundle Gatekeeper 3 Not affected gatekeeper/gatekeeper-rhel9-operator Logging Subsystem for Red Hat OpenShift Not affected openshift-logging/eventrouter-rhel9 Logical Volume Manager Storage Not affected lvms4/lvms-rhel9-operator Logical Volume Manager Storage Not affected lvms4/topolvm-rhel8 Logical Volume Manager Storage Not affected lvms4/topolvm-rhel9 Machine Deletion Remediation Operator Affected workload-availability/machine-deletion-remediation-rhel8-operator Migration Toolkit for Applications 8 Affected mta/mta-cli-rhel9 Migration Toolkit for Containers Affected rhmtc/openshift-migration-registry-rhel8 mirror registry for Red Hat OpenShift 2 Affected openshift/mirror-registry-rhel8 Multiarch Tuning Operator Not affected multiarch-tuning/multiarch-tuning-rhel9-operator Multicluster Engine for Kubernetes Not affected multicluster-engine/discovery-rhel9 Multicluster Engine for Kubernetes Affected multicluster-engine/maestro-rhel9 Multicluster Global Hub Affected multicluster-globalhub/multicluster-globalhub-agent-rhel9 Network Observability Operator Not affected network-observability/network-observability-cli-rhel9 Node HealthCheck Operator Affected node-healthcheck-operator-tech-preview/node-healthcheck-operator-rhel8 OpenShift API for Data Protection Affected oadp/oadp-velero-rhel9 OpenShift Developer Tools and Services Not affected helm OpenShift Lightspeed Affected openshift-lightspeed/otelcol-lightspeed-rhel9 OpenShift Serverless Affected kn-workflow-plugin OpenShift Serverless Affected openshift-serverless-1/kn-plugin-event-sender-rhel9 OpenShift Serverless Affected openshift-serverless-clients OpenShift Service Mesh 3 Not affected openshift-golang-builder-container OpenShift Service Mesh 3 Not affected openshift-service-mesh/kiali-rhel9 OpenShift Source-to-Image (S2I) Not affected source-to-image/source-to-image-rhel8 Power monitoring for Red Hat OpenShift Affected openshift-power-monitoring/kepler-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Affected rhacm2/subctl-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Not affected rhacm2/thanos-rhel9 Red Hat Advanced Cluster Security 4 Not affected advanced-cluster-security/rhacs-main-rhel8 Red Hat Advanced Cluster Security 4 Not affected advanced-cluster-security/rhacs-main-rhel9 Red Hat AMQ Clients Not affected qpid-proton Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-26/receptor-rhel9 Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-27/receptor-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform/platform-operator-bundle Red Hat Ansible Automation Platform 2 Not affected automation-gateway-proxy Red Hat Ansible Automation Platform 2 Not affected automation-gateway-proxy-openssl30 Red Hat Ansible Automation Platform 2 Not affected automation-gateway-proxy-openssl32 Red Hat Ansible Automation Platform 2 Affected python3.11-galaxy-ng Red Hat Ansible Automation Platform 2 Not affected python3.12-galaxy-ng Red Hat Ansible Automation Platform 2 Not affected receptor Red Hat Certification Program for Red Hat Enterprise Linux 9 Affected redhat-certification-preflight Red Hat Connectivity Link 1 Not affected rhcl-1/coredns-rhel9 Red Hat Developer Hub Not affected rhdh/rhdh-rhel9-operator Red Hat Enterprise Linux 10 Not affected buildah Red Hat Enterprise Linux 10 Affected butane Red Hat Enterprise Linux 10 Not affected conmon Red Hat Enterprise Linux 10 Not affected delve Red Hat Enterprise Linux 10 Not affected git-lfs Red Hat Enterprise Linux 10 Affected go-fdo-client Red Hat Enterprise Linux 10 Affected go-fdo-server Red Hat Enterprise Linux 10 Not affected golang Red Hat Enterprise Linux 10 Affected golang-github-openprinting-ipp-usb Red Hat Enterprise Linux 10 Not affected grafana Red Hat Enterprise Linux 10 Not affected grafana-pcp Red Hat Enterprise Linux 10 Affected gvisor-tap-vsock Red Hat Enterprise Linux 10 Affected ignition Red Hat Enterprise Linux 10 Affected image-builder Red Hat Enterprise Linux 10 Affected opentelemetry-collector Red Hat Enterprise Linux 10 Affected osbuild-composer Red Hat Enterprise Linux 10 Not affected podman Red Hat Enterprise Linux 10 Affected python-awscrt Red Hat Enterprise Linux 10 Affected rhc Red Hat Enterprise Linux 10 Not affected rhc-worker-playbook Red Hat Enterprise Linux 10 Affected rhel10/bootc-image-builder Red Hat Enterprise Linux 10 Affected rhel10-eus/rhel-10.0-bootc-image-builder Red Hat Enterprise Linux 10 Not affected skopeo Red Hat Enterprise Linux 10 Affected toolbox Red Hat Enterprise Linux 10 Not affected trustee Red Hat Enterprise Linux 10 Not affected trustee-guest-components Red Hat Enterprise Linux 10 Affected yggdrasil Red Hat Enterprise Linux 7 Affected compat-sap-c++-11 Red Hat Enterprise Linux 7 Affected rhc Red Hat Enterprise Linux 7 Affected rhc-worker-script Red Hat Enterprise Linux 8 Not affected container-tools:rhel8/buildah Red Hat Enterprise Linux 8 Not affected container-tools:rhel8/conmon Red Hat Enterprise Linux 8 Not affected container-tools:rhel8/containernetworking-plugins Red Hat Enterprise Linux 8 Affected container-tools:rhel8/oci-seccomp-bpf-hook Red Hat Enterprise Linux 8 Not affected container-tools:rhel8/podman Red Hat Enterprise Linux 8 Not affected container-tools:rhel8/runc Red Hat Enterprise Linux 8 Not affected container-tools:rhel8/skopeo Red Hat Enterprise Linux 8 Affected container-tools:rhel8/toolbox Red Hat Enterprise Linux 8 Affected git-lfs Red Hat Enterprise Linux 8 Not affected go-toolset:rhel8/golang Red Hat Enterprise Linux 8 Not affected grafana Red Hat Enterprise Linux 8 Not affected grafana-pcp Red Hat Enterprise Linux 8 Affected osbuild-composer Red Hat Enterprise Linux 8 Affected rhc Red Hat Enterprise Linux 8 Not affected weldr-client Red Hat Enterprise Linux 9 Not affected buildah Red Hat Enterprise Linux 9 Affected butane Red Hat Enterprise Linux 9 Not affected conmon Red Hat Enterprise Linux 9 Not affected containernetworking-plugins Red Hat Enterprise Linux 9 Not affected delve Red Hat Enterprise Linux 9 Affected git-lfs Red Hat Enterprise Linux 9 Not affected golang Red Hat Enterprise Linux 9 Not affected golang-github-cpuguy83-md2man Red Hat Enterprise Linux 9 Not affected grafana Red Hat Enterprise Linux 9 Not affected grafana-pcp Red Hat Enterprise Linux 9 Not affected gvisor-tap-vsock Red Hat Enterprise Linux 9 Affected ignition Red Hat Enterprise Linux 9 Affected image-builder Red Hat Enterprise Linux 9 Not affected oci-seccomp-bpf-hook Red Hat Enterprise Linux 9 Affected opentelemetry-collector Red Hat Enterprise Linux 9 Affected osbuild-composer Red Hat Enterprise Linux 9 Not affected podman Red Hat Enterprise Linux 9 Not affected python-awscrt Red Hat Enterprise Linux 9 Affected rhc Red Hat Enterprise Linux 9 Affected rhel9/bootc-image-builder Red Hat Enterprise Linux 9 Will not fix rhel9-eus/rhel-9.6-bootc-image-builder Red Hat Enterprise Linux 9 Not affected runc Red Hat Enterprise Linux 9 Not affected skopeo Red Hat Enterprise Linux 9 Affected toolbox Red Hat Enterprise Linux 9 Not affected trustee-guest-components Red Hat Enterprise Linux 9 Not affected weldr-client Red Hat Enterprise Linux AI (RHEL AI) 3 Affected golang Red Hat Hardened Images Not affected golang1.25 Red Hat Hardened Images Not affected golang1.26 Red Hat Lightspeed for Runtimes Operator Affected rh-lightspeed-runtimes/runtimes-inventory-rhel9-operator Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-rhel9-operator Red Hat OpenShift AI (RHOAI) Not affected rhoai/rhai-cli-rhel9 Red Hat OpenShift Cluster Manager CLI Affected ocm-cli-clients/ocm-cli-rhel9 Red Hat OpenShift Container Platform 4 Affected butane Red Hat OpenShift Container Platform 4 Not affected conmon Red Hat OpenShift Container Platform 4 Not affected conmon-rs Red Hat OpenShift Container Platform 4 Not affected containernetworking-plugins Red Hat OpenShift Container Platform 4 Affected cri-o Red Hat OpenShift Container Platform 4 Affected cri-tools Red Hat OpenShift Container Platform 4 Not affected golang-github-prometheus-promu Red Hat OpenShift Container Platform 4 Affected ignition Red Hat OpenShift Container Platform 4 Affected kata-containers Red Hat OpenShift Container Platform 4 Will not fix microshift Red Hat OpenShift Container Platform 4 Not affected openshift Red Hat OpenShift Container Platform 4 Not affected openshift4/frr-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-cli Red Hat OpenShift Container Platform 4 Affected openshift-clients Red Hat OpenShift Container Platform 4 Not affected openshift-golang-builder-container Red Hat OpenShift Container Platform 4 Affected openshift-kuryr Red Hat OpenShift Container Platform 4 Not affected ose-aws-ecr-image-credential-provider Red Hat OpenShift Container Platform 4 Not affected ose-azure-acr-image-credential-provider Red Hat OpenShift Container Platform 4 Affected ose-crio-credential-provider Red Hat OpenShift Container Platform 4 Not affected ose-gcp-gcr-image-credential-provider Red Hat OpenShift Container Platform 4 Not affected podman Red Hat OpenShift Container Platform 4 Not affected runc Red Hat OpenShift Container Platform 4 Not affected skopeo Red Hat Openshift Data Foundation 4 Not affected odf4/cephcsi-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/udi-rhel9 Red Hat OpenShift Dev Workspaces Operator Affected devworkspace/devworkspace-rhel9-operator Red Hat OpenShift distributed tracing 3 Affected rhosdt/tempo-rhel9 Red Hat OpenShift for Windows Containers Affected openshift4-wincw/windows-machine-config-rhel9-operator Red Hat OpenShift on AWS Affected rosa Red Hat OpenShift Virtualization 4 Not affected container-native-virtualization/kubemacpool-rhel9 Red Hat OpenShift Virtualization 4 Not affected container-native-virtualization/kubevirt-apiserver-proxy-rhel9 Red Hat OpenShift Virtualization 4 Not affected openshift-golang-builder-container Red Hat OpenStack Platform 16.2 Affected etcd Red Hat OpenStack Platform 16.2 Not affected golang-github-infrawatch-apputils Red Hat OpenStack Platform 16.2 Not affected golang-qpid-apache Red Hat OpenStack Platform 16.2 Not affected qpid-proton Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/osp-director-agent Red Hat OpenStack Platform 17.1 Not affected collectd-libpod-stats Red Hat OpenStack Platform 17.1 Affected etcd Red Hat OpenStack Platform 17.1 Not affected golang-github-infrawatch-apputils Red Hat OpenStack Platform 17.1 Not affected golang-qpid-apache Red Hat OpenStack Platform 17.1 Not affected qpid-proton Red Hat OpenStack Platform 17.1 Affected rhosp-rhel9/osp-director-agent Red Hat OpenStack Platform 18.0 Not affected golang-github-openstack-k8s-operators-os-diff Red Hat OpenStack Platform 18.0 Affected rhoso-operators/sg-core-rhel9 Red Hat Quay 3 Affected quay/quay-rhel8 Red Hat Quay 3 Affected quay/quay-rhel9 Red Hat Satellite 6 Not affected dynflow-utils Red Hat Satellite 6 Not affected rubygem-dynflow Red Hat Satellite 6 Not affected satellite/iop-vmaas-rhel9 Red Hat Satellite 6 Not affected yggdrasil-worker-forwarder Red Hat Service Interconnect 2 Affected skupper-cli Red Hat Service Interconnect 2 Affected skupper-router Red Hat Web Terminal Affected web-terminal/web-terminal-exec-rhel9 Security Profiles Operator Not affected compliance/openshift-selinuxd-rhel8 Service Telemetry Framework 1.5 Not affected stf/sg-core-rhel9 streams for Apache Kafka 2 Not affected golang-github-danielqsj-kafka_exporter streams for Apache Kafka 3 Not affected golang-github-danielqsj-kafka_exporter Zero Trust Workload Identity Manager Not affected zero-trust-workload-identity-manager/spiffe-csi-driver-rhel9 Zero Trust Workload Identity Manager - Tech Preview Will not fix zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-71235 https://nvd.nist.gov/vuln/detail/CVE-2026-71235 https://github.com/absmach/magistrala